ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Vidar infostealer by monitoring for matches against a curated set of ten specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections and prevent data exfiltration before the malware establishes persistence or spreads laterally across the environment.

IOC Summary

Malware Family: Vidar Total IOCs: 10 IOC Types: domain, url, sha1_hash, md5_hash, sha256_hash

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["vog.akasia988.net", "dbm.akasia988.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://joemartinwords.com/", "https://bestpackers.org/", "https://yshaastro.in/", "https://vog.akasia988.net/", "https://dbm.akasia988.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["ec0078d806fcb7b0ef538a51ae03217888ce1bd3e96a73beceecc2c12675d77d", "018356c22bf7997520cc341b97eb7e6e4b4ccb67", "bf8ec2994ca75d5e09c66a0fc740459e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Endpoint Protection Engine Updates

  • Context: The organization’s EDR solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically downloads definition updates or engine patches from the vendor’s cloud repository. These update packages often contain hash signatures and network artifacts that overlap with Vidar IOCs, particularly regarding DLL injection behaviors or specific file hashes used in legitimate security tooling.
  • Filter/Exclusion: Create a rule exclusion based on the process name of the EDR updater (e.g., MsMpEng.exe for Defender or FalconSensorService.exe) and filter out alerts where the parent process is the system update service (TrustedInstaller or WindowsUpdate).

• Scenario: Automated Backup and Archiving Jobs

  • Context: Scheduled enterprise backup solutions (such as Veeam, Commvault, or Rubrik) perform nightly compression and encryption tasks. These tools frequently utilize memory-resident agents that inject code into running processes to capture state, mimicking the “process hollowing” or “DLL injection” techniques often flagged by Vidar detections.
  • Filter/Exclusion: Exclude alerts occurring during defined maintenance windows (e.g., 02:00–04:00 local time) where the initiating process is a known backup agent (e.g., VeeamAgent.exe or CommServe.exe) and the file path resides within the designated backup staging directory.

• Scenario: Internal Software Deployment via Configuration Management

  • Context: IT operations teams use tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ansible to push software updates to workstations. During deployment,