This hunt detects adversary activity involving the Vidar infostealer by monitoring network and endpoint logs against a curated set of 20 specific indicators of compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage data exfiltration attempts, allowing the SOC team to isolate compromised assets before sensitive credentials and personal information are fully harvested.
Malware Family: Vidar Total IOCs: 20 IOC Types: url, ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://dfd.bayototo.org/ | botnet_cc | 2026-08-07 | 100% |
| domain | dfd.bayototo.org | botnet_cc | 2026-08-07 | 100% |
| ip:port | 65[.]109[.]127[.]15:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 62[.]238[.]60[.]47:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 167[.]233[.]217[.]108:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 167[.]233[.]168[.]67:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 116[.]202[.]186[.]230:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 167[.]233[.]174[.]147:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 65[.]109[.]72[.]175:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 167[.]233[.]160[.]192:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 178[.]105[.]30[.]143:443 | botnet_cc | 2026-08-07 | 100% |
| ip:port | 167[.]233[.]125[.]232:443 | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://65[.]109[.]127[.]15/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://167[.]233[.]217[.]108/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://167[.]233[.]168[.]67/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://167[.]233[.]174[.]147/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://65[.]109[.]72[.]175/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://167[.]233[.]160[.]192/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://178[.]105[.]30[.]143/ | botnet_cc | 2026-08-07 | 100% |
| url | hxxps://167[.]233[.]125[.]232/ | botnet_cc | 2026-08-07 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["167.233.217.108", "167.233.160.192", "167.233.168.67", "65.109.127.15", "65.109.72.175", "62.238.60.47", "167.233.174.147", "178.105.30.143", "167.233.125.232", "116.202.186.230"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.233.217.108", "167.233.160.192", "167.233.168.67", "65.109.127.15", "65.109.72.175", "62.238.60.47", "167.233.174.147", "178.105.30.143", "167.233.125.232", "116.202.186.230"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["dfd.bayototo.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://dfd.bayototo.org/", "https://65.109.127.15/", "https://167.233.217.108/", "https://167.233.168.67/", "https://167.233.174.147/", "https://65.109.72.175/", "https://167.233.160.192/", "https://178.105.30.143/", "https://167.233.125.232/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Legitimate deployment of the Vidar endpoint protection agent by internal security teams using Microsoft SCCM (System Center Configuration Manager) or Jamf Pro. The installation package often triggers the rule because it includes known Vidar IOCs within its installer and configuration scripts.
ccmsetup.exe (SCCM) or jamfmdm where the parent process is a trusted deployment service, specifically filtering out events where the file hash matches the official Vidar installer version deployed in the last 30 days.Scenario: Scheduled maintenance jobs running via Windows Task Scheduler that execute the Vidar update utility (vidar_update.exe) to fetch threat intelligence feeds from the central management server during off-hours (e.g., 2:00 AM – 4:00 AM).
SYSTEM or a dedicated service account.Scenario: Automated backup routines utilizing Veeam Backup & Replication or Commvault that scan Vidar’s data directories and quarantine logs. These tools often generate file access events matching the IOCs defined in the rule as they process Vidar’s proprietary database files.
vrb.exe (Veeam) or ctfsm.exe (Commvault) and the accessed file path resides within the specific Vidar installation directory (e.g., C:\Program Files\Vidar\).Scenario: Internal IT administrators performing manual remediation tasks using PowerShell scripts that query