ThreatFox: Satacom IOCs

Hunt Hypothesis

This hunt hypothesis detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Satacom threat actor, which may signal active reconnaissance or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate affected assets and mitigate potential data exfiltration before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Satacom Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Satacom
let malicious_urls = dynamic(["https://shoeshowshoes.com/nfront.php", "https://dressagelaval.com/nfront.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Satacom

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Satacom IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Endpoint Scans

  • Context: Enterprise endpoint protection suites (e.g., Microsoft Defender, CrowdStrike Falcon) often perform scheduled deep scans of network traffic and file hashes. If the Satacom IOCs correspond to known benign vendor signatures or update servers used by these tools, the scan engine may generate alerts when it queries or downloads data from these sources during its maintenance window.
  • Filter/Exclusion: Exclude process names associated with the EDR agent (e.g., MsMpEng.exe, CsFalconService) and specific scheduled task IDs (e.g., “Defender Scheduled Scan”) that occur between 02:00 and 04:00 daily.

• Scenario: Automated Software Deployment via Configuration Management

  • Context: IT operations teams frequently use tools like Microsoft SCCM, Ansible, or Puppet to push software updates or configuration patches. If the Satacom IOCs represent a repository server or a specific update package used in these deployments, the rule will trigger when the deployment agent (e.g., ccmexec.exe for SCCM) initiates a connection to fetch the payload.
  • Filter/Exclusion: Create an exclusion based on the source IP ranges of the Configuration Management infrastructure and filter out events where the parent process is identified as a known deployment service account (e.g., NT SERVICE\ccmexec or specific Ansible runner accounts).

• Scenario: Third-Party Cloud Backup and Archiving Services

  • Context: Many enterprises utilize cloud-based backup solutions (such as Veeam, Rubrik, or Acronis) that communicate with external storage gateways. If the S