ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Vidar malware by monitoring network and endpoint logs for matches against its known indicators of compromise (IOCs). Proactive hunting in Azure Sentinel is critical to identify early-stage infections that may evade signature-based detection, allowing the SOC team to rapidly isolate affected assets before lateral movement occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 15 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
url	hxxps://tek.beri303.org/	botnet_cc	2026-08-12	100%
domain	tek.beri303.org	botnet_cc	2026-08-12	100%
url	hxxps://tek.sm188castle.top	botnet_cc	2026-08-12	100%
domain	tek.sm188castle.top	botnet_cc	2026-08-12	100%
domain	yoda-gd1.shop	botnet_cc	2026-08-12	100%
url	hxxps://gem.bercak4d.org	botnet_cc	2026-08-12	100%
url	hxxps://109[.]120[.]178[.]84	botnet_cc	2026-08-12	100%
url	hxxps://tek.sm188blood.top/	botnet_cc	2026-08-12	100%
domain	tek.bercak4d.org	botnet_cc	2026-08-12	100%
url	hxxps://tek.bercak4d.org/	botnet_cc	2026-08-12	100%
domain	tek.sm188blood.top	botnet_cc	2026-08-12	100%
domain	nul.sm188blood.top	botnet_cc	2026-08-12	100%
url	hxxps://nul.sm188blood.top/	botnet_cc	2026-08-12	100%
url	hxxps://nul.bercak4d.org/	botnet_cc	2026-08-12	100%
domain	nul.bercak4d.org	botnet_cc	2026-08-12	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["tek.beri303.org", "tek.sm188castle.top", "yoda-gd1.shop", "tek.bercak4d.org", "tek.sm188blood.top", "nul.sm188blood.top", "nul.bercak4d.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://tek.beri303.org/", "https://tek.sm188castle.top", "https://gem.bercak4d.org", "https://109.120.178.84", "https://tek.sm188blood.top/", "https://tek.bercak4d.org/", "https://nul.sm188blood.top/", "https://nul.bercak4d.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — Vidar

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Endpoint Protection Scans by Defender or CrowdStrike

  • Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently download definition updates or perform scheduled scans that generate network traffic matching Vidar’s known IOCs (specifically DNS queries to update servers or HTTP downloads of signature files). The detection logic may flag these legitimate update mechanisms as the initial infection vector of Vidar.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name and Parent Process. Exclude any network activity where the process name is MsMpEng.exe (Defender) or csfalcon.exe (CrowdStrike) and the parent process is the respective EDR service. Additionally, filter out traffic destined for known Microsoft update domains (e.g., go.microsoft.com, update.microsoft.com) if they match the Vidar IOCs.

• Scenario: Scheduled Backup Jobs via Veeam or Commvault

  • Context: Automated backup solutions often utilize cloud storage connectors that initiate connections to external repositories or management consoles. If the Vidar IOCs include specific IP ranges or domain names used by these backup vendors’ management portals, scheduled nightly jobs (e.g., VeeamBackupService running at 02:00 AM) will trigger false alerts due to high-volume data transfer patterns similar to Vidar’s C2 behavior.
  • Filter/Exclusion: Implement a time-based exclusion for the specific backup window (e.g., exclude detections between 01:00 and 05:00 UTC). Furthermore, add an exclusion for processes named vrb.exe (Veeam) or `comm