ThreatFox: HijackLoader IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the HijackLoader malware by identifying six specific indicators of compromise that signal potential command-and-control communication or payload delivery within the network. A proactive search in Azure Sentinel is essential to rapidly identify and isolate these high-severity threats before they can establish persistence or exfiltrate sensitive data from the environment.

IOC Summary

Malware Family: HijackLoader Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`e0d61ce862f8bcfde7643cd1230bb14441516fb5`	payload	2026-07-27	95%
md5_hash	`72990e94e0316066e2fc625b64fa0626`	payload	2026-07-27	95%
sha256_hash	`ef56d1386af7c97a5cd0b70c261de7e87f6c00894e3f30856adfc750a7b73b3b`	payload	2026-07-27	95%
sha1_hash	`58a7e2f5ca176afbdeffc8634bdb5bc105b91dde`	payload	2026-07-27	95%
md5_hash	`17005c9a5f2a9a57fe71ced46712c688`	payload	2026-07-27	95%
sha256_hash	`62e631c68ba9392dc91e19cdc4f5e00bc0e303764c9f5c27ce2be6bf40bcc933`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - HijackLoader
let malicious_hashes = dynamic(["e0d61ce862f8bcfde7643cd1230bb14441516fb5", "72990e94e0316066e2fc625b64fa0626", "ef56d1386af7c97a5cd0b70c261de7e87f6c00894e3f30856adfc750a7b73b3b", "58a7e2f5ca176afbdeffc8634bdb5bc105b91dde", "17005c9a5f2a9a57fe71ced46712c688", "62e631c68ba9392dc91e19cdc4f5e00bc0e303764c9f5c27ce2be6bf40bcc933"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — HijackLoader

False Positive Guidance

Here are the false positive scenarios and corresponding exclusion strategies for the ThreatFox: HijackLoader IOCs detection rule:

Scenario: Endpoint Protection Scanning of Quarantine Archives
- Context: Enterprise antivirus solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently scan archived quarantine folders containing historical malware samples. These archives often include legacy IOCs (hashes, file paths) that match the HijackLoader signature set, triggering alerts when the scanner processes these benign, isolated files during routine maintenance windows.
- Filter/Exclusion: Exclude process names associated with the endpoint protection engine (e.g., C:\Program Files\CrowdStrike\FalconSensor\csagent.exe, MsMpEng.exe) and restrict the detection scope to exclude file paths within known quarantine directories (e.g., \Quarantine\, \Archive\).
Scenario: Scheduled Software Update Deployments via Configuration Management
- Context: Automated deployment tools such as Microsoft SCCM (Configuration Manager) or Ivanti Neurons often push application updates that include installer packages containing the specific IOCs monitored by this rule. When these agents execute scheduled jobs during business hours to update legacy applications, they may generate file artifacts matching the HijackLoader indicators, causing high-volume false positives across the user base.
- Filter/Exclusion: Create a whitelist for known deployment service accounts (e.g., DOMAIN\CCM_Service, IvantiAgent) and exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these mass update jobs are active.
Scenario: Legacy Internal Application Execution by Administrators
- Context: System administrators frequently utilize internal, custom-built management utilities or legacy line-of-business applications that rely on older libraries containing the HijackLoader