ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity involving the Vidar infostealer by monitoring for specific indicators of compromise such as file hashes and network connections. Proactive hunting in Azure Sentinel is critical to rapidly detect early-stage data exfiltration attempts and prevent lateral movement before sensitive credentials are compromised.

IOC Summary

Malware Family: Vidar Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`eed9618dd94b86fe10990521889cabbedc6ea329`	payload	2026-08-02	95%
md5_hash	`91912c07e3b6893dc8113e77b0923309`	payload	2026-08-02	95%
sha256_hash	`dc87cc13bad5c4cc715ace4737ac6f303994a68ec8a772067da9765d642e1b28`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["eed9618dd94b86fe10990521889cabbedc6ea329", "91912c07e3b6893dc8113e77b0923309", "dc87cc13bad5c4cc715ace4737ac6f303994a68ec8a772067da9765d642e1b28"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Vidar IOCs detection rule in an enterprise environment:

Scenario: Endpoint Protection Scanning of Quarantined Archives
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often scan large quarantined archives or backup logs that contain historical malware signatures. These files may include embedded hashes matching known Vidar IOCs from previous incidents, triggering the rule even though the current environment is clean.
- Filter/Exclusion: Exclude alerts where the source process is the EDR service itself (e.g., C:\Program Files\CrowdStrike\fs_qc.exe or C:\Windows\System32\MsMpEng.exe) and the file path resides within a dedicated quarantine directory (e.g., paths containing \Quarantine\ or \Backup\).
Scenario: Scheduled Security Baseline Scans by Admin Tools
- Context: Automated security compliance tools like Tenable Nessus, Qualys, or custom PowerShell scripts run nightly to validate endpoint configurations. These tools often load reference libraries containing the latest ThreatFox IOCs (including Vidar) into memory for comparison against live systems, causing a “hit” on the detection logic without actual infection.
- Filter/Exclusion: Create an exclusion based on the process name of known security management agents (e.g., qualyspc.exe, nscd.exe) or specific scheduled tasks defined in Task Scheduler with names like “Daily Security Baseline Check.”
Scenario: Deployment of New Software via Configuration Management
- Context: During routine software deployments using tools like Microsoft SCCM (Configuration Manager) or Ansible, the deployment agents unpack application installers. If the installer package includes a dependency library or security module that shares a hash with a