ThreatFox: pupy IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Pupy remote access tool by monitoring specific Indicators of Compromise (IOCs) that signal potential command and control communications or lateral movement. A proactive hunt in Azure Sentinel is essential to rapidly isolate compromised endpoints and prevent data exfiltration, given Pupy’s high severity classification and its frequent use in advanced persistent threats targeting cloud environments.

IOC Summary

Malware Family: pupy Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - pupy
let malicious_ips = dynamic(["45.140.204.12"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.140.204.12"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — pupy

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: pupy IOCs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) tools like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform periodic telemetry checks. During these scans, the agents may download threat intelligence feeds from ThreatFox or similar repositories that contain pupy signatures as part of a broader malware definition update, triggering network connections to known IOCs without actual infection.
  • Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike, MsiDefender) or filter out processes matching the EDR agent executable names (C:\Program Files\CrowdStrike\fsqu.exe or C:\Windows\System32\MsMpEng.exe).

• Scenario: Scheduled Software Deployment via Configuration Management

  • Context: IT operations teams use tools like Ansible, SCCM (Configuration Manager), or Jenkins to deploy software updates. A scheduled job might provision a development environment where pupy is used as a legitimate remote management utility for internal IoT devices or legacy kiosks, causing the deployment engine to establish connections with pupy-related IOCs during nightly maintenance windows.
  • Filter/Exclusion: Create an exclusion rule based on the source process name (e.g., ccmexec.exe, java.exe running under a specific user context like svc-deployment) and restrict the alert scope to non-workstation IP ranges (e.g., exclude the 10.20.x.x management subnet).

• Scenario: Legitimate Remote Access by DevOps Engineers

  • Context: DevOps engineers utilize pupy