ThreatFox: Vidar IOCs

Hunt Hypothesis

This detection rule identifies the presence of Vidar, a sophisticated credential-stealing malware known for harvesting sensitive authentication data and exfiltrating it to remote command-and-control servers. Proactive hunting in Azure Sentinel is critical because early identification of Vidar’s indicators allows the SOC team to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistent access to internal systems.

IOC Summary

Malware Family: Vidar Total IOCs: 5 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["stt.majusm188.top", "stt.77zeus.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://45.83.180.74", "https://stt.majusm188.top/", "https://stt.77zeus.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, tailored for an enterprise environment:

• Scenario: Legitimate execution of the Microsoft Defender for Endpoint (MDE) or CrowdStrike Falcon agent performing a scheduled full system scan.

  • Context: The security agent’s scanning process often generates network traffic and file access patterns that mimic Vidar’s exfiltration behavior, specifically when uploading telemetry data to the cloud management console.
  • Filter/Exclusion: Create a rule exclusion for processes originating from C:\Program Files\Microsoft Defender Antivirus\bin\MsMpEng.exe (or the specific CrowdStrike sensor path) where the destination IP belongs to the vendor’s known cloud update ranges, excluding any traffic to external public IPs.

• Scenario: Automated backup jobs running via Veeam Backup & Replication or Rubrik.

  • Context: During scheduled backup windows, these tools compress and transmit large volumes of data over the network. The high-volume outbound transfer and file hashing activities can trigger Vidar’s exfiltration signatures, particularly if the backup destination is a public cloud storage bucket (e.g., AWS S3 or Azure Blob).
  • Filter/Exclusion: Exclude alerts where the source process name contains VeeamTransport.exe or rubrik-agent, and the destination port corresponds to standard HTTPS (443) traffic directed toward known backup service endpoints.

• Scenario: Execution of a System Center Configuration Manager (SCCM) or Intune deployment task.

  • Context: When SCCM pushes software updates, patches, or configuration scripts to endpoint machines, the client agent (ccmsetup.exe or CcmExec) establishes persistent connections to distribution points and management servers. This traffic can resemble the command-and-control (