This rule detects the presence of Vidar, a data exfiltration malware that actively harvests credentials and sensitive information from compromised hosts. Proactively hunting for these IOCs allows the SOC to identify and isolate infected endpoints before the adversary successfully exfiltrates stolen data or establishes a persistent foothold within the Azure environment.
Malware Family: Vidar Total IOCs: 8 IOC Types: url, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://fefeo.iknowthat.space | botnet_cc | 2026-09-26 | 75% |
| url | hxxp://dzdi.serendipityhub.space | botnet_cc | 2026-09-26 | 75% |
| url | hxxps://95[.]217[.]241[.]133 | botnet_cc | 2026-09-26 | 75% |
| url | hxxps://www.pinterest.com/m1duus | botnet_cc | 2026-09-26 | 75% |
| url | hxxps://65[.]108[.]201[.]76 | botnet_cc | 2026-09-26 | 75% |
| url | hxxps://91[.]98[.]111[.]49 | botnet_cc | 2026-09-26 | 75% |
| url | hxxps://2[.]28[.]9[.]232 | botnet_cc | 2026-09-26 | 75% |
| sha256_hash | 819b8c72cf69208a6206fe5642011b9d6b54fd83c9eac0646526bc39b32d86e5 | payload | 2026-09-26 | 100% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["http://fefeo.iknowthat.space", "http://dzdi.serendipityhub.space", "https://95.217.241.133", "https://www.pinterest.com/m1duus", "https://65.108.201.76", "https://91.98.111.49", "https://2.28.9.232"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["819b8c72cf69208a6206fe5642011b9d6b54fd83c9eac0646526bc39b32d86e5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Credential Harvesting via RDP Clipboard Sync: Administrators or support staff using Remote Desktop Protocol (RDP) with clipboard synchronization enabled may inadvertently copy sensitive strings (e.g., API keys, connection strings) from a remote server to their local workstation. If the local machine runs a security agent that monitors clipboard content or process memory for known Vidar IOCs (such as specific regex patterns for credential formats), this legitimate copy-paste action can trigger a false positive.
mstsc.exe (Remote Desktop Client) or rdpclip.exe (RDP Clipboard) from memory scanning rules that look for credential-like strings, or allowlist specific user groups (e.g., “IT-Support-Admins”) when the source process is an RDP client.Scheduled Backup Job Reading Credential Files: Enterprise backup solutions (e.g., Veeam, Commvault) or custom PowerShell scripts often read configuration files containing plaintext credentials (e.g., backup_config.xml, credentials.ini) to connect to source systems. If the Vidar detection rule includes file-based IOCs that match common credential file names or specific hash values of known config templates, these scheduled jobs (running under SYSTEM or a dedicated service account) can trigger alerts.
C:\Program Files\Veeam\Backup and Replication\...) and exclude files located in standard backup configuration directories (e.g., C:\ProgramData\Veeam\Backup and Replication\) from file-based IOC matching.CI/CD Pipeline Artifact Scanning: In DevOps environments, build agents (e.g., Jenkins, Azure DevOps, GitHub Actions) frequently download and scan artifact files (JARs, DLLs, scripts) that may contain embedded version strings, build