ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of Vidar malware, a credential-stealing tool that often establishes command-and-control channels via specific URLs to exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify active exfiltration attempts and isolate affected systems before the adversary successfully harvests critical credentials or sensitive information.

IOC Summary

Malware Family: Vidar Total IOCs: 2 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://45[.]86[.]64[.]51`	botnet_cc	2026-09-23	100%
url	`hxxps://2[.]29[.]60[.]19`	botnet_cc	2026-09-23	100%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://45.86.64.51", "https://2.29.60.19"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice, where the build artifact is hosted on a temporary S3 bucket or Azure Blob Storage container that shares a URL pattern with known Vidar C2 infrastructure.
- Filter/Exclusion: Exclude URLs where the host matches internal CI/CD artifact repositories (e.g., *.s3.amazonaws.com with specific bucket prefixes, or *.blob.core.windows.net with known container names) and the user agent identifies as a known CI/CD bot (e.g., Jenkins, GitHubActions).
Scenario: An IT administrator performs a scheduled software update or patch deployment using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy, where the installer package is downloaded from a shared internal file server or a third-party update mirror that coincidentally matches a Vidar IOC URL.
- Filter/Exclusion: Exclude network connections where the source process is a known deployment agent (e.g., ccmexec.exe, pdqdeploy.exe) and the destination IP is within the internal management network range (e.g., 10.0.0.0/8 or 172.16.0.0/12).
Scenario: A marketing team uses a third-party email marketing platform (e.g., Mailchimp or HubSpot) to send out a campaign, and the tracking pixel or landing page URL used for analytics is hosted on a CDN or subdomain that matches a Vidar IOC.
- Filter/Exclusion: Exclude HTTP/HTTPS requests where the user agent contains Mozilla and the referrer header points to a known email client or marketing platform domain (e.g., *.mailchimp.com, *.hubspot.net), or where the process is a standard web