ThreatFox: Phorpiex IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific Indicators of Compromise (IOCs) linked to the Phorpiex threat actor, which are known to deploy sophisticated malware and phishing campaigns targeting enterprise environments. A SOC team should proactively hunt for these IOCs within Azure Sentinel to identify early-stage intrusions and mitigate potential data exfiltration or lateral movement before they escalate into broader incidents.

IOC Summary

Malware Family: Phorpiex Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`b084c127f03f2d2b96dae95d2495ea8e`	payload	2026-08-02	95%
sha256_hash	`40a1831b2c77c3026e01b6eb0e9846dd3c909ced0f55cb396165d23d9e5926c9`	payload	2026-08-02	95%
sha1_hash	`a0816745f3159d06733ed351425ef25ba8ae2eb9`	payload	2026-08-02	95%
sha1_hash	`06047aeb37556139c4cd4ffa7a6cf7f801f3d161`	payload	2026-08-02	95%
md5_hash	`71a63b374d229f30f2912c501f7cce07`	payload	2026-08-02	95%
sha256_hash	`fcf3ceac44b1c95dcc7442ddac5b286f64954c00cc09a265eeedd4638dbfac2e`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Phorpiex
let malicious_hashes = dynamic(["b084c127f03f2d2b96dae95d2495ea8e", "40a1831b2c77c3026e01b6eb0e9846dd3c909ced0f55cb396165d23d9e5926c9", "a0816745f3159d06733ed351425ef25ba8ae2eb9", "06047aeb37556139c4cd4ffa7a6cf7f801f3d161", "71a63b374d229f30f2912c501f7cce07", "fcf3ceac44b1c95dcc7442ddac5b286f64954c00cc09a265eeedd4638dbfac2e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Phorpiex

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Phorpiex IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates via WSUS or SCCM
- Context: Enterprise endpoints running Microsoft Defender or third-party AV (e.g., CrowdStrike) often pull definition updates through Windows Server Update Services (WSUS) or System Center Configuration Manager (SCCM). The update packages may contain hashes matching Phorpiex IOCs if the vendor uses a shared certificate or common library.
- Filter/Exclusion: Exclude traffic originating from known internal WSUS servers (10.x.x.x range) and SCCM management points. Additionally, filter out processes where the parent process is wsusclient.exe, ccmexec.exe, or MsMpSvc.exe.
Scenario: Legitimate Cloud Backup Agents Performing Incremental Backups
- Context: Automated backup agents (e.g., Veeam Agent for Windows, Rubrik, or Acronis Cyber Protect) frequently execute scheduled jobs that scan and hash large volumes of data. These agents often utilize Phorpiex-associated libraries for encryption or compression, triggering the rule during peak backup windows (e.g., 02:00–04:00).
- Filter/Exclusion: Create a time-based exclusion window for known backup job schedules. Furthermore, exclude processes with executable paths containing \Veeam\, \Rubrik\, or \Acronis\ and filter by the specific Service Account used for backups (e.g., DOMAIN\svc_backup_agent).
Scenario: Third-Party Endpoint Detection & Response (EDR) Telemetry
- Context: EDR solutions like Carbon Black, SentinelOne, or Symantec