ThreatFox: Tofsee IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the Tofsee threat actor, which often signals early-stage reconnaissance or lateral movement within the network. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain potential Tofsee intrusions before they escalate into broader data exfiltration or system compromise events.

IOC Summary

Malware Family: Tofsee Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tofsee
let malicious_ips = dynamic(["157.20.182.81"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.20.182.81"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tofsee

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Tofsee IOCs detection rule in an enterprise environment:

• Legitimate Scenario: The corporate IT team utilizes a third-party vulnerability scanner (e.g., Tenable Nessus or Qualys) that periodically queries external threat intelligence feeds. During its daily update cycle, the scanner’s service account establishes outbound connections to Tofsee’s API endpoints to fetch the latest malware signatures and reputation data.

  • Suggested Filter: Create an exclusion based on the specific Service Account User ID (e.g., svc-tenable-updater) or restrict the rule trigger to only alert when the source IP is outside the defined “Security Tools” subnet range (e.g., 10.20.50.0/24).

• Legitimate Scenario: A scheduled PowerShell job running on the central Configuration Management Database (CMDB) server (managed via Microsoft System Center Configuration Manager / SCCM) executes a nightly script to enrich asset inventory data. This script calls an external enrichment service that relies on Tofsee IOCs to tag assets with current threat intelligence attributes.

  • Suggested Filter: Implement a time-based exclusion for the rule, suppressing alerts during the known maintenance window (e.g., 02:00 AM – 04:00 AM local time) or filter by the specific Process Name of the script executor (e.g., powershell.exe with command line containing -TofseeEnrichment).

• Legitimate Scenario: The enterprise’s Endpoint Detection and Response (EDR) platform (such as CrowdStrike Falcon or Microsoft Defender for Endpoint) is configured to automatically ingest external IOC feeds. The EDR management console initiates a background synchronization task that connects directly to Tofsee servers to update the local threat