ThreatFox: Tofsee IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring network and endpoint logs for specific Indicators of Compromise (IOCs) linked to the Tofsee threat actor, which is known for targeting financial institutions with advanced persistent threats. The SOC team should proactively hunt for these IOCs in Azure Sentinel because early identification of Tofsee’s unique signatures enables rapid containment before the adversary can establish a foothold and exfiltrate sensitive data.

IOC Summary

Malware Family: Tofsee Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`102[.]220[.]160[.]58:425`	botnet_cc	2026-08-11	75%
ip:port	`102[.]220[.]160[.]58:417`	botnet_cc	2026-08-11	75%
ip:port	`102[.]220[.]160[.]58:423`	botnet_cc	2026-08-11	75%
ip:port	`102[.]220[.]160[.]58:416`	botnet_cc	2026-08-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tofsee
let malicious_ips = dynamic(["102.220.160.58"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.58"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Tofsee

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Tofsee IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Security Tool Updates
- Context: The endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a nightly scheduled update job that downloads definition files from the Tofsee repository. This triggers the IOC match as the tool queries the specific hash or domain associated with Tofsee.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., FalconSensor.exe or MsMpEng.exe) and the Parent Process being the scheduled task runner (svchost.exe). Additionally, restrict the alert to only fire if the user context is not a local system account.
Scenario: Admin-Initiated Threat Intelligence Feed Integration
- Context: A Security Operations Center (SOC) analyst manually imports Tofsee threat intelligence feeds into the SIEM or EDR console via an administrative script. The ingestion process generates network traffic and file artifacts matching the Tofsee IOCs, mimicking a potential compromise.
- Filter/Exclusion: Exclude alerts where the Source User belongs to the “Security Admins” group or specific service accounts (e.g., svc-siem-ingest). Alternatively, filter out events occurring within a defined maintenance window (e.g., 02:00–04:00 UTC) when these integrations are typically run.
Scenario: Internal Threat Hunting Dashboard Queries
- Context: The internal threat hunting team utilizes a dashboard tool (such as Splunk or Elastic Security) that periodically polls the Tofsee API to refresh real-time IOC lists for their own dashboards. This polling activity generates legitimate network