← Back to SOC feed Coverage →

ThreatFox: Tofsee IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
iocthreatfoxwin-tofsee
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-08T23:00:01Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against a curated set of 56 Indicators of Compromise (IOCs) specific to the Tofsee threat actor. Proactive hunting for these IOCs in Azure Sentinel is critical to identify early-stage intrusions from this high-severity campaign before they escalate into broader lateral movement or data exfiltration events.

IOC Summary

Malware Family: Tofsee Total IOCs: 56 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port217[.]60[.]241[.]48:421botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:421botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:427botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:430botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:420botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:422botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]50:422botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:422botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]48:422botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]48:423botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:423botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]50:423botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:423botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:421botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]50:421botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:417botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:428botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:419botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:431botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:431botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:416botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:417botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]31:424botnet_cc2026-08-0875%
ip:port217[.]60[.]241[.]50:424botnet_cc2026-08-0875%
ip:port130[.]12[.]182[.]79:424botnet_cc2026-08-0875%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tofsee
let malicious_ips = dynamic(["217.60.241.48", "130.12.182.79", "217.60.241.50", "217.60.241.31"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.241.48", "130.12.182.79", "217.60.241.50", "217.60.241.31"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Tofsee IOCs detection rule in an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/win.tofsee/