ThreatFox: Prometei IOCs

Hunt Hypothesis

This hunt detects adversary activity involving three specific Indicators of Compromise (IOCs) linked to the Prometei threat actor, which may signal early-stage reconnaissance or lateral movement within the environment. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential Prometei-related intrusions before they escalate into broader incidents.

IOC Summary

Malware Family: Prometei Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`cd1378bb22fa98439afecc6cf3e657b3633ed37b`	payload	2026-08-08	95%
md5_hash	`fde4bb9242202ad2ec42ab19a0fdd453`	payload	2026-08-08	95%
sha256_hash	`10505f035b1e6569cb22d42614829e85fd432e014418f457e2e1dfc31dcd505c`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Prometei
let malicious_hashes = dynamic(["cd1378bb22fa98439afecc6cf3e657b3633ed37b", "fde4bb9242202ad2ec42ab19a0fdd453", "10505f035b1e6569cb22d42614829e85fd432e014418f457e2e1dfc31dcd505c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Prometei

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Prometei IOCs rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Endpoint Protection Updates
- Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During nightly maintenance windows (e.g., 02:00–04:00), the endpoint protection service automatically queries external threat intelligence feeds to download new definition signatures. This network traffic often matches Prometei’s known IOCs if they are part of a shared upstream feed or a specific vendor partnership.
- Suggested Filter/Exclusion: Create an exclusion rule based on Source Process Name and Time Window. Exclude alerts where the source process is FalconSensor.exe (or MsMpEng.exe) occurring between 02:00 and 04:00 local time.
Scenario: Automated Software Deployment via SCCM/Intune
- Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy a new security analytics agent that integrates with Prometei’s ecosystem. During the initial installation or patching phase, the deployment engine (ccmsetup.exe or WindowsUpdateAgent) establishes outbound connections to Prometei’s update servers to validate license keys and fetch configuration manifests.
- Suggested Filter/Exclusion: Implement a filter excluding traffic originating from specific Deployment Service Accounts (e.g., NT SERVICE\CCMEXEC or SYSTEM) where the destination port is restricted to standard HTTPS (443) and the source IP belongs to the internal management subnet.
Scenario: Third-Party SIEM Enrichment Job
- Context: The organization runs a nightly data enrichment job using **