ThreatFox: Vidar IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Vidar infostealer to conduct large-scale data exfiltration campaigns targeting sensitive assets within our Azure Sentinel environment. Proactive hunting for these specific IOCs is critical to identify early-stage compromise and mitigate potential data loss before the malware establishes persistence or expands its lateral movement.

IOC Summary

Malware Family: Vidar Total IOCs: 5 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["ets.luckyturbo88.top", "ets.aww88.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://cldaa.org/", "https://ets.luckyturbo88.top/", "https://ets.aww88.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via Microsoft Intune/SCCM

  • Scenario: The Vidar malware is known to use legitimate Windows components for exfiltration. When the IT team pushes a scheduled policy update (e.g., Microsoft Defender Antivirus definition updates) via Microsoft Endpoint Configuration Manager (MECM) or Intune, the background service (MpCmdRun.exe) may initiate large outbound connections to Microsoft’s content delivery networks, mimicking Vidar’s exfiltration behavior.
  • Suggested Filter: Exclude network traffic where the User-Agent contains “Microsoft-Defender” and the destination IP belongs to the Microsoft Corporation ASN (AS8075), specifically targeting ports 443 and 80 during business hours (e.g., 09:00–17:00 local time).

• Automated Backup Jobs using Veeam or Commvault

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault Simpana frequently perform data exfiltration to cloud repositories (e.g., AWS S3, Azure Blob) during scheduled maintenance windows. The backup agents running on workstations often utilize PowerShell scripts (powershell.exe) or specific service executables that generate high-volume outbound traffic patterns identical to the Vidar IOC signatures.
  • Suggested Filter: Create an exclusion for processes named VeeamAgent.exe, cvpexec.exe, or CommServe.exe communicating with known internal backup proxy IPs or whitelisted cloud storage endpoints (e.g., *.blob.core.windows.net) during the defined maintenance window (e.g., 02:00–0