ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt identifies potential compromise by Vidar, a remote access trojan known for stealing credentials and banking information, by correlating its specific indicators of compromise against your environment. Proactively hunting for these IOCs in Azure Sentinel is critical to detect lateral movement or data exfiltration attempts before the adversary establishes persistent control over sensitive assets.

IOC Summary

Malware Family: Vidar Total IOCs: 7 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["pz.32naga.net", "pz.5-rt.org", "bh.5-rt.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://pz.32naga.net/", "https://pz.5-rt.org/", "https://ji.5-rt.org", "https://bh.5-rt.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Antivirus/EDR Real-Time Scanning and Quarantine Operations: Security tools like Microsoft Defender for Endpoint or CrowdStrike Falcon may generate file system events or process creation logs when scanning or quarantining files that match Vidar IOCs (e.g., specific PE headers or hash values) during routine full-system scans or on-access protection.

  • Filter/Exclusion: Exclude events where the parent process is a known security agent (e.g., MsMpEng.exe, FalconSensor.exe) or where the action is explicitly “Quarantine” or “Scan” rather than “Execute.”

• Software Deployment via Group Policy or SCCM: Enterprise IT teams often deploy updates, patches, or new applications using System Center Configuration Manager (SCCM) or Group Policy Objects (GPOs). If a deployed package contains a component that matches one of the Vidar IOCs (e.g., a specific DLL version or file path), the deployment service (ccmexec.exe or svchost.exe with GPO context) will create or modify the file, triggering the rule.

  • Filter/Exclusion: Exclude file creation/modification events where the parent process is ccmexec.exe, wsus, or svchost.exe with the gpupdate service, or where the source path includes standard deployment directories like C:\Windows\CCM\ or C:\ProgramData\SCCM\.

• Backup and Archive Operations: Backup solutions such as Veeam, Commvault, or Windows Server Backup may read or write files to backup repositories. If a backup job processes a file that matches a Vidar IOC (e.g., a specific executable or configuration file) and the backup agent creates a temporary copy or log entry matching the IOC, it can trigger the detection.

  • Filter/Exclusion: Exclude events where the parent