ThreatFox: Vidar IOCs

Hunt Hypothesis

This detection rule identifies active threats by matching network and endpoint telemetry against four specific Indicators of Compromise (IOCs) linked to the Vidar malware family. Proactively hunting for these IOCs in Azure Sentinel is critical because Vidar’s modular architecture allows it to persistently exfiltrate sensitive data, making early identification essential to prevent long-term compromise before automated alerts trigger.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["dev.masihsm188.top", "dev.8bitbola.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://dev.masihsm188.top/", "https://dev.8bitbola.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

False Positive Scenarios for “ThreatFox: Vidar IOCs” Rule

• Scenario: Legitimate deployment of the Vidar Endpoint Protection suite by the Security Operations team using Microsoft SCCM (Configuration Manager). During a mass rollout, the installer and associated services generate network traffic matching the rule’s IOCs (e.g., specific DLL hashes or registry keys) as part of the normal installation process.

  • Suggested Filter: Exclude events where the Process Name is ccmsetup.exe or wuauserv.exe running under the NT SERVICE\CCM context, and restrict the rule to trigger only when the source IP belongs to non-management subnets (excluding the SCCM server range).

• Scenario: Scheduled nightly maintenance jobs executed by the IT Infrastructure team using Ansible Tower or PowerShell DSC. These automation scripts periodically query Vidar management consoles to verify agent health, triggering network connections that match the detection logic’s IOCs for control channel communication.

  • Suggested Filter: Create an exclusion based on Scheduled Task Name containing “Vidar_Health_Check” and limit alerts to business hours (08:00–18:00) or exclude traffic originating from the specific Ansible Tower controller IP address (192.168.10.5).

• Scenario: Routine software updates pushed via SolarWinds Patch Manager for third-party applications that integrate with Vidar (e.g., updating a database connector used by Vidar). The update process involves downloading components and registering new services, which generates file creation events matching the IOCs defined in the hunt package.

  • Suggested Filter: Exclude alerts where the User Account is a service account named svc-patch-deploy or svc-vidar-updater, and add a condition to ignore events