ThreatFox: Supper IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects adversary activity involving three specific Indicators of Compromise (IOCs) linked to the “Supper” threat, signaling potential initial access or lateral movement within the environment. SOC teams should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain early-stage compromises before they escalate into broader incidents.

IOC Summary

Malware Family: Supper Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`b77d5d846a70f979b1b4d5761bb4967f037ea841`	payload	2026-07-27	95%
md5_hash	`4124a167cef576ccae119247431709f6`	payload	2026-07-27	95%
sha256_hash	`6a12f1b9d531003b507b251a6fbbd9fc8c3673bb386852749c161730fbc312d9`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Supper
let malicious_hashes = dynamic(["b77d5d846a70f979b1b4d5761bb4967f037ea841", "4124a167cef576ccae119247431709f6", "6a12f1b9d531003b507b251a6fbbd9fc8c3673bb386852749c161730fbc312d9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Supper

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: Supper IOCs detection rule:

Scenario 1: Scheduled Security Tool Updates
- Context: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a nightly scheduled update that fetches the latest IOC feeds from ThreatFox. This process generates network traffic and file hashes matching the “Supper” package IOCs during the maintenance window (02:00–04:00 UTC).
- Suggested Filter/Exclusion: Create an exclusion rule based on Process Name (FalconSensor.exe or MsMpEng.exe) and Time Window. Exclude alerts triggered by these specific processes between 01:30 and 05:00 UTC.
Scenario 2: Admin-Driven Threat Intelligence Feed Import
- Context: A Security Operations Center (SOC) analyst manually imports the “Supper” IOC package into the SIEM or EDR console via a PowerShell script (Import-ThreatFoxIOCs.ps1) to refresh the detection engine. This administrative task triggers the rule immediately upon execution, even though it is an authorized configuration change rather than a threat.
- Suggested Filter/Exclusion: Exclude alerts where the User Account matches specific service accounts (e.g., svc-threat-mgmt or admin-soc) and the Process Command Line contains keywords like “Import” or “Update-Feed”.
Scenario 3: Patch Management Deployment via SCCM/Intune
- Context: The IT Operations team deploys a new security patch using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment agent downloads the Supper IOC definitions as part of the payload, causing the detection