ThreatFox: Vidar IOCs

Hunt Hypothesis

This rule detects potential Vidar malware infections by identifying outbound network connections to known malicious URLs used for data exfiltration and credential theft. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints early, preventing the silent extraction of sensitive data before it reaches external threat actors.

IOC Summary

Malware Family: Vidar Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://ma.1hoki.org", "https://ma.19hoki.org", "https://192.142.37.129"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Scenario: A DevOps team executes a scheduled curl or wget job to fetch a configuration file or software dependency from a public GitHub repository or CDN that happens to share the same IP/URL pattern as a known Vidar exfiltration endpoint.
  • Filter/Exclusion: Exclude outbound traffic from specific service accounts (e.g., svc-ci-cd, build-agent) or restrict the rule to only trigger on non-standard ports (e.g., exclude port 443 if the IOC is on 443 and the traffic is from known internal CI/CD subnets).
• Scenario: An IT administrator manually downloads a patch or diagnostic tool from a vendor’s support portal or a public software mirror (e.g., download.microsoft.com or a specific Linux distro mirror) that is hosted on an IP address previously associated with Vidar C2 infrastructure in threat intelligence feeds.
  • Filter/Exclusion: Create an allowlist for known vendor domains and public software repositories (e.g., *.github.com, *.microsoft.com, *.ubuntu.com) to suppress alerts on standard HTTPS traffic (port 443) from these specific domains.
• Scenario: A network monitoring tool or a backup agent (e.g., Veeam, Commvault) performs a health check or telemetry upload to a public endpoint that coincidentally matches a Vidar IOC IP/URL, often because the tool uses a generic public API or CDN for updates.
  • Filter/Exclusion: Exclude traffic from known backup and monitoring service accounts (e.g., svc-backup, zabbix-agent) or filter by user-agent strings if the rule inspects HTTP headers, allowing only standard browser or known application user-agents.
• Scenario: A developer uses a public API for testing (e.g., httpbin.org, `postman-