ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the Vidar malware to exfiltrate sensitive data through stolen Kerberos tickets and NTLM hashes, often delivered via phishing campaigns that compromise credential security. Proactively hunting for these indicators in Azure Sentinel is critical because early detection of Vidar’s specific IOCs can prevent large-scale data breaches before attackers successfully leverage compromised credentials to move laterally within the network.

IOC Summary

Malware Family: Vidar Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`01f84e942908ccb2fc657d9dd1caf8b5`	payload	2026-08-08	95%
sha1_hash	`c6cc775f76f0aced85206c313b452f29334c6ac9`	payload	2026-08-08	95%
sha256_hash	`30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa`	payload	2026-08-08	95%
sha256_hash	`dc1e2425521c3ff8344ea04a2294730e8ddda29da11b809421b85c896a693cad`	payload	2026-08-08	95%
sha1_hash	`365ee4d8c9c3b3b10f07b41b316a745452e8e00b`	payload	2026-08-08	95%
md5_hash	`d5cf90d75595ae54fad924f7ea2861dc`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["01f84e942908ccb2fc657d9dd1caf8b5", "c6cc775f76f0aced85206c313b452f29334c6ac9", "30064a241c39541e287ccbe04f1027a037a10918528384479d27b53a23c2b1aa", "dc1e2425521c3ff8344ea04a2294730e8ddda29da11b809421b85c896a693cad", "365ee4d8c9c3b3b10f07b41b316a745452e8e00b", "d5cf90d75595ae54fad924f7ea2861dc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Phishing Simulation Campaigns
- Context: Security teams frequently run internal phishing simulations using tools like KnowBe4, Proofpoint, or Microsoft Defender for Office 365. These campaigns often distribute emails containing attachments (PDFs, Word docs) and links that mimic the behavior of Vidar’s initial delivery vector. If the simulation includes a macro-enabled attachment or a specific URL pattern matching Vidar’s IOCs, it may trigger the rule.
- Filter/Exclusion: Exclude traffic originating from internal mail servers or specific simulation domains (e.g., *.simulation-security.com, *.knowbe4.net). Additionally, filter out events where the user account is part of a dedicated “Phishing_Test” security group in Active Directory.
Scenario: Scheduled Backup and Data Exfiltration Jobs
- Context: Vidar focuses on data exfiltration via Kerberos tickets. Enterprise backup solutions like Veeam, Rubrik, or Commvault often run scheduled jobs that extract large volumes of sensitive data over the network using service accounts with high privileges (mimicking Vidar’s credential theft behavior). These jobs may generate NTLM hash exchanges and large outbound traffic patterns indistinguishable from malicious exfiltration.
- Filter/Exclusion: Create an exclusion for specific Service Accounts used by backup infrastructure (e.g., svc_backup_prod, svc_veeam). Filter events occurring during known maintenance windows (e.g., 02:00–04:00 UTC) where these scheduled jobs are active.
Scenario: Third-Party Cloud Synchronization and Reporting Tools
- Context: