ThreatFox: GUIDLOADER IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging GUIDLOADER as a multi-stage malware loader that establishes persistence and command-and-control channels following initial compromise via phishing or exploits. Proactive hunting for these IOCs in Azure Sentinel is critical to detect early-stage infections before they execute subsequent payloads, thereby preventing lateral movement and data exfiltration within the environment.

IOC Summary

Malware Family: GUIDLOADER Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`ccad1d780f53e439985bc9e6035211d7`	payload	2026-07-24	95%
sha256_hash	`3fc2edb46b7b5bb430b2e63b7da48dcbef35a63884e219edac2960131062a651`	payload	2026-07-24	95%
sha1_hash	`39fdafcbeac903723edc9e6919c4fc733a642d3d`	payload	2026-07-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GUIDLOADER
let malicious_hashes = dynamic(["ccad1d780f53e439985bc9e6035211d7", "3fc2edb46b7b5bb430b2e63b7da48dcbef35a63884e219edac2960131062a651", "39fdafcbeac903723edc9e6919c4fc733a642d3d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GUIDLOADER

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: GUIDLOADER IOCs rule, along with suggested filters and exclusions tailored for an enterprise environment:

Legitimate Scenario: Microsoft Office Macro Execution in Shared Templates
- Context: Users frequently open standardized Excel or Word templates containing macros that utilize COM objects (GUIDs) to load external libraries or connect to internal data sources. The macro engine often generates a process tree resembling the GUIDLOADER multi-stage execution pattern, triggering the rule when it spawns child processes with specific hash signatures.
- Suggested Filter/Exclusion: Create an exclusion based on the parent process name (EXCEL.EXE or WINWORD.EXE) and restrict the detection to only trigger if the file path is outside of trusted network shares (e.g., exclude paths starting with \\FileServer\Templates\). Additionally, whitelist known macro hash signatures from the internal template repository.
Legitimate Scenario: Scheduled PowerShell Jobs for Configuration Management
- Context: Enterprise automation tools like Ansible, Chef, or custom PowerShell scripts often run scheduled tasks that load dynamic modules via GUID-based identifiers to apply configuration changes. These jobs frequently spawn a loader process that downloads and executes payloads, mimicking the C2 communication behavior of the malware.
- Suggested Filter/Exclusion: Implement a filter excluding alerts where the parent process is TASKENG.EXE (Task Scheduler) or SYSTEM user account, specifically when the command line arguments contain keywords like “Configuration,” “Update,” or specific internal script paths (e.g., C:\ProgramData\Automation\Scripts\).
Legitimate Scenario: Endpoint Detection and Response (EDR) Self-Healing Updates
- Context: Major EDR solutions such as CrowdStrike Falcon, **Carbon