ThreatFox: Phorpiex IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating network and endpoint logs against 15 specific Indicators of Compromise (IOCs) linked to the Phorpiex threat actor. A SOC team should proactively hunt for these signals in Azure Sentinel because Phorpiex is a prolific malware distributor known for rapid campaign evolution, requiring early identification to prevent lateral movement and data exfiltration before full-scale infection occurs.

IOC Summary

Malware Family: Phorpiex Total IOCs: 15 IOC Types: sha1_hash, sha256_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Phorpiex
let malicious_hashes = dynamic(["136eef90751334d3718816c1f16b37668db305ed", "258b98ded097462bc668ee1ca8e56c60", "f04b1e5629e167d21f16eac25416c316472af070", "0cade3a07d296e0e228a45df3657311a", "324a60acad30f9940a829594943d9e7a33ad1c32989b35ff6545e5a2df759be6", "6f941dfcffe99df17e9f8a5052127d0b42ae5ed6e4636a7e4ffe0b89161acbb8", "34c6e16bc42a5af390991d61f78a98bc6ed87c2f", "8347c0d21537e847ab3572dd45ba17d5", "980f07f67302d588946e920dfdabdca3d3a8a05d", "4f7a468bdcf482f08bd014ae52db5299", "72da1a3abc1230fdbb9a1a7ac21b490b6482e14cbcfa9b8f5913af03d99fabde", "a3b454082dcbf17d64ec6539870404fb7dd99ba49a69f7f4d98b1b31c436c199", "405904c8a9ec04b73ac95b7e43a4c9c567b526d178257b56e4a8d812f478ddc3", "449e042db9b793c224bb1fbdf024e3ba8adde226", "00dee4b7bc493f6c89e9e5dc9467f892"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Phorpiex

False Positive Guidance

False Positive Scenarios for “ThreatFox: Phorpiex IOCs” Rule

• Legitimate Endpoint Protection Updates

  • Scenario: The enterprise’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads and installs a new definition package. This process often involves connecting to known update servers that share IP addresses or hash signatures with the Phorpiex IOC set, triggering a match during nightly maintenance windows.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name of the EDR service (e.g., FalconSensor.exe or MsMpEng.exe) and restrict the alert to only fire outside of the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scheduled Third-Party Backup Jobs

  • Scenario: A scheduled backup job configured in Veeam or Commvault runs on a daily basis. The backup agent initiates network connections to external storage gateways or cloud repositories that utilize infrastructure overlapping with Phorpiex IOCs, causing the detection logic to flag these routine connectivity events as suspicious.
  • Suggested Filter/Exclusion: Implement an exclusion based on Source User (e.g., SYSTEM or a dedicated service account like svc-backup) and filter out alerts where the Destination IP falls within the known CIDR block of the enterprise’s backup storage provider.

• Software Deployment via Configuration Management

  • Scenario: The IT Operations team utilizes Ansible or Microsoft SCCM to push a new software patch or application installation across the domain. During the execution phase, the deployment agent establishes connections to public repositories (e.g., GitHub Actions runners or Azure Artifacts) that match the Phorpiex hash signatures, generating alerts during active business hours.