ThreatFox: Metaencryptor IOCs

Hunt Hypothesis

This hunt targets the presence of known Metaencryptor indicators of compromise, which are frequently leveraged by ransomware operators to encrypt critical data and disrupt operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the encryption process begins, thereby reducing the potential impact of a high-severity ransomware event.

IOC Summary

Malware Family: Metaencryptor Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Metaencryptor
let malicious_urls = dynamic(["https://89.46.235.116:9443/", "https://89.46.235.116:80/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Metaencryptor

False Positive Guidance

• Scenario: A DevOps team deploys a new encryption service using the openssl command-line tool or a Python script (cryptography library) to encrypt large data files for archival, generating temporary files with extensions like .enc or .meta that match the IOC file patterns.

  • Filter/Exclusion: Exclude processes originating from python.exe, openssl.exe, or pwsh.exe when the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe) or when the working directory is within a standard build path (e.g., C:\builds\, /var/lib/jenkins/).

• Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black) or a backup solution (e.g., Veeam, Commvault) performs a full-volume backup or snapshot, creating temporary encrypted container files in the system drive that match the Metaencryptor’s file naming conventions or hash patterns.

  • Filter/Exclusion: Exclude events where the parent process is a known backup or EDR agent binary (e.g., falconctl.exe, cb.exe, veeamagent.exe) and the file path resides in a designated backup or temp directory (e.g., C:\ProgramData\Commvault\, C:\Windows\Temp\).

• Scenario: A security team runs a manual threat hunt or YARA scan using tools like yara64.exe or flare-floss against a specific directory, which may generate intermediate encrypted or packed files during analysis that align with the IOC criteria.

  • Filter/Exclusion: Exclude processes named yara64.exe, floss.exe, or strings.exe when the command line arguments contain keywords like --scan, -r, or specific directory paths associated with threat hunting work