ThreatFox: Vidar IOCs

Hunt Hypothesis

This rule detects the presence of Vidar malware, a credential stealer that often arrives via phishing and uses encrypted channels to exfiltrate sensitive data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the malware successfully transmits stolen credentials or sensitive information to threat actors.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["kz.zk89.net", "kz.199cuan.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://kz.199cuan.org/", "https://se.zk89.net"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

• Scenario: Scheduled Credential Rotation via PowerShell

  • Description: An IT operations team uses a scheduled PowerShell script to rotate service account passwords or extract local admin credentials for auditing purposes. The script may invoke cmd.exe with specific arguments or use net use/whoami commands that match Vidar’s credential harvesting IOCs (e.g., specific command-line patterns or process creation chains).
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains keywords like -Credential, -Rotate, or specific internal script paths (e.g., C:\Scripts\CredRotation\). Additionally, exclude if the process is initiated by a known service account (e.g., svc-itops) rather than an interactive user.

• Scenario: Enterprise Backup Agent Execution

  • Description: Backup software agents (e.g., Veeam, Commvault, or Rubrik) often run as high-privilege services and may spawn child processes to read file metadata or execute verification tasks. These agents might use encrypted channels or specific DLLs that overlap with Vidar’s exfiltration IOCs, particularly if the rule triggers on specific network connections or process injection techniques.
  • Filter/Exclusion: Exclude processes where the parent process name matches known backup agent binaries (e.g., vssadmin.exe, commvaultagent.exe, rubrikagent.exe) or if the process path resides in standard backup installation directories (e.g., C:\Program Files\Veeam\, C:\Program Files\Commvault\).

• Scenario: Phishing Simulation Campaigns

  • Description: Security teams conduct regular phishing simulations using tools like Gophish or KnowBe4. These simulations often deliver payloads or execute scripts that mimic real malware behavior to test user response.