ThreatFox: SnappyClient IOCs

Hunt Hypothesis

This hunt identifies potential compromise by SnappyClient, a high-severity threat actor, by matching known indicators of compromise against Azure Sentinel telemetry. Proactively hunting for these IOCs allows the SOC to detect and isolate affected assets before the adversary can establish persistence or exfiltrate data.

IOC Summary

Malware Family: SnappyClient Total IOCs: 4 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SnappyClient
let malicious_domains = dynamic(["leebin101.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SnappyClient
let malicious_urls = dynamic(["https://leebin101.com/", "https://leebin101.com/r", "https://leebin101.com/g.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SnappyClient

False Positive Guidance

• Scenario: A security engineer or DevOps team deploys a custom Python-based utility script (e.g., snappy_sync.py) that leverages the snappy compression library for data transfer between on-premises storage and cloud buckets. The script’s hash or filename matches one of the 4 IOCs because it was built from a known open-source template or shared artifact.

  • Filter/Exclusion: Exclude processes where the parent process is python.exe or python3.exe and the command line contains arguments related to sync, upload, or compress. Alternatively, whitelist the specific SHA256 hash of the internal utility script in the IOC list.

• Scenario: An IT administrator runs a scheduled maintenance task using PowerShell to clean up temporary files in the C:\Temp directory, invoking a helper script named snappy_cleanup.ps1 that was copied from a shared network drive (\\fileserver\IT\Scripts). The script name or path matches an IOC due to the “snappy” keyword.

  • Filter/Exclusion: Exclude events where the process name is powershell.exe and the command line includes -File or -ExecutionPolicy with a path starting with \\fileserver\IT\Scripts\ or C:\ProgramData\IT\.

• Scenario: A development team uses a CI/CD pipeline agent (e.g., Jenkins or GitLab Runner) that executes a build step involving a custom Go binary named snappy-client-builder to compress artifacts before deployment. The binary’s hash matches an IOC because it was compiled from a shared internal repository without re-hashing.

  • Filter/Exclusion: Exclude processes where the parent process is java.exe (Jenkins) or gitlab-runner and the working directory is within the CI/CD workspace (e.g