ThreatFox: SnappyClient IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific indicators of compromise (IOCs) linked to the SnappyClient tool, which may signal reconnaissance or data exfiltration efforts within the environment. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage threats and mitigate potential risks before they escalate into broader security incidents.

IOC Summary

Malware Family: SnappyClient Total IOCs: 4 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - SnappyClient
let malicious_ips = dynamic(["217.144.187.85", "95.179.151.97"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.144.187.85", "95.179.151.97"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SnappyClient
let malicious_domains = dynamic(["dreamlinestream.com", "yodagoodie.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — SnappyClient

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SnappyClient IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune pushes a scheduled update to the SnappyClient application on endpoints during maintenance windows. This triggers network connections and file integrity checks matching the rule’s IOCs.
  • Filter/Exclusion: Exclude traffic originating from known SCCM Distribution Points or Intune Management Service IPs. Additionally, filter out events where the process path matches C:\Program Files\SnappyClient\bin\snappy-updater.exe running under the SYSTEM or a specific service account (e.g., DOMAIN\PatchService).

• Scenario: Scheduled Backup and Archive Jobs

  • Context: Enterprise backup solutions like Veeam, Commvault, or Rubrik initiate nightly jobs that scan and archive data within directories monitored by SnappyClient. The rule may flag the high I/O volume and specific hash signatures of these backup agents as suspicious IOCs.
  • Filter/Exclusion: Create an exclusion for processes running under VeeamTransportService, CommvaultAgent, or RubrikBackup that interact with paths containing \SnappyClient\. Alternatively, suppress alerts during the defined maintenance window (e.g., 02:00 – 05:00 local time) for backup-related network flows.

• Scenario: Endpoint Detection and Response (EDR) Scanning

  • Context: The organization’s primary EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a real-time scan on the SnappyClient installation directory. The EDR engine generates its