ThreatFox: MyDoom IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of six specific indicators of compromise (IOCs) linked to the MyDoom worm, which historically spreads via email attachments and network shares to establish a foothold in compromised systems. A SOC team should proactively hunt for these IOCs within Azure Sentinel because MyDoom’s legacy propagation mechanisms remain effective against modern environments, allowing early identification of potential reinfection or lateral movement before significant impact occurs.

IOC Summary

Malware Family: MyDoom Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`62fa24c9f3f0cb8f0ef411ecd4d0939e775bcbadc30ae8a0ac4e999dae049dbb`	payload	2026-07-24	95%
sha1_hash	`dc845713ee9669971e967f0f68546be718e5bc25`	payload	2026-07-24	95%
md5_hash	`d121235211b62df289ee961414e06fa4`	payload	2026-07-24	95%
sha1_hash	`8dc5ef895d1606cc53ca4f67e6936517cdd14c60`	payload	2026-07-24	95%
md5_hash	`016fc23a8337a322ffdc0f850efa7a7f`	payload	2026-07-24	95%
sha256_hash	`602cc7985ad5a2a05425cfa1b16aa7a6e00165455a6d6566234141bc787ff8e9`	payload	2026-07-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MyDoom
let malicious_hashes = dynamic(["62fa24c9f3f0cb8f0ef411ecd4d0939e775bcbadc30ae8a0ac4e999dae049dbb", "dc845713ee9669971e967f0f68546be718e5bc25", "d121235211b62df289ee961414e06fa4", "8dc5ef895d1606cc53ca4f67e6936517cdd14c60", "016fc23a8337a322ffdc0f850efa7a7f", "602cc7985ad5a2a05425cfa1b16aa7a6e00165455a6d6566234141bc787ff8e9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MyDoom

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: MyDoom IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legacy Email Archiving System Scanning
- Scenario: The organization’s on-premise email archiving solution (e.g., Veritas Enterprise Vault or Microsoft Exchange Archive) periodically scans historical mailboxes. During these deep-scan cycles, the system generates network traffic and file hashes that match MyDoom’s known signatures due to legacy attachment formats stored in the archive.
- Filter/Exclusion: Create a rule exclusion based on the specific Hostname or IP Address range of the archiving server (e.g., vault-archive-01.corp.local). Additionally, filter out alerts where the process name is VaultArchiver.exe or msarchiver.exe.
Antivirus Engine Signature Updates
- Scenario: The endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) performs a scheduled signature database update. The update package often contains internal hashes that overlap with MyDoom’s IOCs, triggering the detection logic as if an active threat was found on the host.
- Filter/Exclusion: Exclude alerts where the Process Name matches the AV engine updater (e.g., FalconSensor.exe, SentinelOneAgent.exe) and the User Context is a system account like SYSTEM or NT AUTHORITY\LOCAL SERVICE.
Scheduled Patch Deployment via Configuration Management
- Scenario: A nightly patch deployment job runs using Microsoft Endpoint Configuration Manager (SCCM) or Ansible. During the distribution of specific security patches, the agent downloads and executes a script that generates network connections to known MyDoom indicator domains