ThreatFox: Latrodectus IOCs

Hunt Hypothesis

This hunt identifies network connections or host artifacts matching IOCs associated with the Latrodectus threat actor, a group known for targeting financial and government sectors. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect potential intrusions early, as Latrodectus often employs stealthy techniques to establish persistence and exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: Latrodectus Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Latrodectus
let malicious_domains = dynamic(["registeredagentsingeorgia.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Latrodectus
let malicious_urls = dynamic(["https://precisionproving.com/?v=xg5wadc814", "https://precisionproving.com/?v=nbjj2j8gqy"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Latrodectus

False Positive Guidance

• Scenario: A DevOps team deploys a new microservice container image that includes a static binary or library file whose SHA-256 hash matches one of the Latrodectus IOCs due to a shared dependency or build artifact.

  • Filter/Exclusion: Exclude alerts where the detected hash is found within a known container registry (e.g., Docker Hub, ECR) or within specific application directories (e.g., /opt/app/lib/) and the process parent is a container runtime (e.g., dockerd, containerd-shim).

• Scenario: An IT administrator performs a manual software update or patching task using a tool like winget or choco that downloads a component from a third-party repository, and the downloaded file’s hash coincidentally matches an IOC (perhaps due to a common open-source library version).

  • Filter/Exclusion: Exclude alerts where the file path is under standard package manager cache directories (e.g., C:\ProgramData\chocolatey\, %LOCALAPPDATA%\Packages\) and the creating process is a known package manager executable (e.g., winget.exe, choco.exe).

• Scenario: A security team runs a YARA scan or a file integrity monitoring (FIM) tool across the endpoint fleet, which temporarily creates or accesses files with hashes matching the IOCs during the scanning process, or the tool itself bundles a library with a matching hash.

  • Filter/Exclusion: Exclude alerts where the process name is a known security tool (e.g., yara.exe, osqueryd.exe, crowdagent.exe) or the file path is within the tool’s working directory or temporary scan location (e.g., C:\Temp\yara_scan\).

• Scenario: A developer clones a GitHub repository that contains a test fixture