ThreatFox: Prometei IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against eighteen specific Indicators of Compromise (IOCs) linked to the Prometei threat campaign. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity threat enables rapid containment before adversaries can establish persistence or exfiltrate sensitive data within the environment.

IOC Summary

Malware Family: Prometei Total IOCs: 18 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6	payload	2026-07-27	95%
sha1_hash	f9ec500cc050101e0e2f45f94e6906edd9fb8d2b	payload	2026-07-27	95%
md5_hash	3549f1fba922f40330aaa081ce71fed2	payload	2026-07-27	95%
sha1_hash	64ba56ced1e0e90c8d4452705796474c8ebb1704	payload	2026-07-27	95%
md5_hash	5f31264fd0ff12d16e2bdc00ca1aa9bb	payload	2026-07-27	95%
sha256_hash	5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75	payload	2026-07-27	95%
sha1_hash	a5412dccd1a204bcd76e09b99a16140da3b9bf09	payload	2026-07-27	95%
md5_hash	1e613dec8beebebd6baaea91998a628e	payload	2026-07-27	95%
sha1_hash	53fa5d6d3cf75f2444a38907d1170cd820cf2196	payload	2026-07-27	95%
md5_hash	d2577b85f5a29ef579bfdfdb64cfa874	payload	2026-07-27	95%
sha256_hash	998ea71c9c2d89374f17d5dc2d0d83abd5845849af7d87cff96542614e3364a4	payload	2026-07-27	95%
sha1_hash	ba088de3a2d3e05a7af056af4a47912f64f96201	payload	2026-07-27	95%
md5_hash	bd11a6b7c86bfe4e0fd407b0be2554e9	payload	2026-07-27	95%
sha256_hash	c17da88435a502ed14c705832371807419a7494a26be1c32329d4dc017477f09	payload	2026-07-27	95%
sha1_hash	84252044f7af6478ec0d2db1f5f6330ae8341b11	payload	2026-07-27	95%
md5_hash	81c226154c7663bb3f1b0df208dcf664	payload	2026-07-27	95%
sha256_hash	d2e9f95d58c56a2c000577b00a0d04bb96d8f9479e115c8dbd20e00195604971	payload	2026-07-27	95%
sha256_hash	7fecb00580517395eab594588d4b4efd2154d6160f20ee8da298d613d9223e64	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Prometei
let malicious_hashes = dynamic(["5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6", "f9ec500cc050101e0e2f45f94e6906edd9fb8d2b", "3549f1fba922f40330aaa081ce71fed2", "64ba56ced1e0e90c8d4452705796474c8ebb1704", "5f31264fd0ff12d16e2bdc00ca1aa9bb", "5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75", "a5412dccd1a204bcd76e09b99a16140da3b9bf09", "1e613dec8beebebd6baaea91998a628e", "53fa5d6d3cf75f2444a38907d1170cd820cf2196", "d2577b85f5a29ef579bfdfdb64cfa874", "998ea71c9c2d89374f17d5dc2d0d83abd5845849af7d87cff96542614e3364a4", "ba088de3a2d3e05a7af056af4a47912f64f96201", "bd11a6b7c86bfe4e0fd407b0be2554e9", "c17da88435a502ed14c705832371807419a7494a26be1c32329d4dc017477f09", "84252044f7af6478ec0d2db1f5f6330ae8341b11", "81c226154c7663bb3f1b0df208dcf664", "d2e9f95d58c56a2c000577b00a0d04bb96d8f9479e115c8dbd20e00195604971", "7fecb00580517395eab594588d4b4efd2154d6160f20ee8da298d613d9223e64"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Prometei

False Positive Guidance

Here are 5 specific false positive scenarios and their corresponding filters/exclusions for the ThreatFox: Prometei IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The enterprise’s endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) automatically downloads definition updates from a vendor server that shares an IP address with one of the Prometei IOCs. This triggers the rule during nightly maintenance windows.
  • Filter/Exclusion: Create a time-based exclusion allowing traffic to this specific IOC IP between 02:00 and 04:00 UTC, or add the specific source FQDN (e.g., updates.defender.microsoft.com) to an allow-list if the Prometei IOC is known to overlap with major vendor update servers.

• Scenario: Third-Party Cloud Backup Synchronization

  • Context: A scheduled backup job using Veeam or Commvault initiates a connection to a cloud storage provider whose gateway IP matches one of the 18 Prometei IOCs. This occurs daily at 09:00 AM when the backup agent polls for status.
  • Filter/Exclusion: Exclude traffic originating from specific “Backup Service” accounts (e.g., svc-backup-agent) or restrict the rule to exclude connections where the destination port is strictly limited to standard backup ports (such as 9443 or 8080) rather than generic web browsing ports.

• Scenario: Admin Remote Management via RDP/SSH

  • Context: A system administrator performs routine maintenance on a development server that has recently been migrated to a new subnet, and the admin’s jump host IP coincides with one of the Prometei indicators. The rule triggers when the admin establishes an RDP session using a standard management tool like BeyondTrust or