ThreatFox: vSkimmer IOCs

Hunt Hypothesis

This hunt targets the presence of nine specific IOCs linked to the vSkimmer malware, a high-severity threat known for injecting malicious code into web pages to steal sensitive user data. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets or lateral movement attempts before the malware can successfully exfiltrate credentials or financial information.

IOC Summary

Malware Family: vSkimmer Total IOCs: 9 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - vSkimmer
let malicious_domains = dynamic(["www.bookson7thave.com", "www.fosterbooks.co.uk", "www.gibsonbooks.com", "www.lectioz.com", "www.literarycatbooks.com", "www.mostlyusefulfictions.com", "www.roundtablebooks.com", "www.thebooktique.org", "www.vintage-books.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — vSkimmer

False Positive Guidance

• Legacy Application Deployment via Group Policy: The vSkimmer IOCs often include specific MD5 hashes or file paths associated with older, unpatched versions of Java Runtime Environment (JRE) or specific Adobe Flash Player components that were historically targeted. If an enterprise maintains a legacy line-of-business application (e.g., a custom Java-based inventory system) that relies on an older JRE version (e.g., 1.8.0_202) deployed via Group Policy Objects (GPO) to a specific OU, the IOC hash match will trigger on every workstation in that OU.

  • Filter/Exclusion: Exclude alerts where the parent process is gpupdate.exe or gpedit.msc, or restrict the rule to exclude file paths under C:\Program Files\Java\jre1.8.0_202\ for the specific OU “Legacy_Apps” in Active Directory.

• Scheduled Backup Agent Initialization: Some vSkimmer IOCs target the svchost.exe process loading specific DLLs or creating temporary files in %TEMP% with predictable naming conventions (e.g., vsk_*.tmp). In environments using enterprise backup solutions like Veeam or Commvault, the backup agent (vbragent.exe or cvagent.exe) may spawn helper processes that create temporary staging files in the user’s temp directory during the initial connection phase to the backup server. If the naming convention coincidentally matches an IOC string, it triggers a false positive.

  • Filter/Exclusion: Exclude events where the parent process is vbragent.exe, cvagent.exe, or ntrtscan.exe, or filter out file creation events where the file path contains Veeam or Commvault in the directory structure.

• Third-Party Endpoint Detection & Response (EDR) Telemetry Collection: Advanced