ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies active indicators of compromise linked to the XWorm malware, specifically targeting six known threat signatures that signal potential lateral movement and data exfiltration attempts. A proactive hunt is essential in Azure Sentinel to rapidly isolate infected endpoints before this worm propagates across the network, thereby minimizing dwell time and preventing widespread system disruption.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`103[.]67[.]163[.]6:443`	botnet_cc	2026-08-12	75%
ip:port	`151[.]241[.]154[.]218:2021`	botnet_cc	2026-08-12	75%
ip:port	`104[.]249[.]10[.]187:7004`	botnet_cc	2026-08-12	75%
ip:port	`107[.]174[.]20[.]215:8824`	botnet_cc	2026-08-12	75%
ip:port	`217[.]60[.]195[.]74:443`	botnet_cc	2026-08-12	75%
domain	`xwsub.cincv.group`	botnet_cc	2026-08-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["107.174.20.215", "151.241.154.218", "103.67.163.6", "217.60.195.74", "104.249.10.187"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["107.174.20.215", "151.241.154.218", "103.67.163.6", "217.60.195.74", "104.249.10.187"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["xwsub.cincv.group"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

Scenario: Automated Antivirus Definition Updates
- Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon frequently download new definition signatures from the cloud. These updates often contain file hashes that match known XWorm variants within the ThreatFox IOCs, triggering alerts during nightly update cycles.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., MsMpEng.exe or FalconSensorService) and restrict the alert to only trigger if the process is not running under the System account context during the defined maintenance window (02:00 – 04:00 UTC).
Scenario: Scheduled Backup Agent Scans
- Context: The organization utilizes Veeam Backup & Replication or Rubrik agents which perform deep file system scans and temporary staging of data. These agents often generate temporary files with hashes identical to XWorm IOCs while processing large datasets, leading to high-volume noise during backup windows.
- Filter/Exclusion: Exclude alerts where the Parent Process is vbrsvc.exe (Veeam) or rubrik-agent.exe, and add a condition to suppress events occurring within specific Backup Window Groups defined in the SIEM’s asset inventory.
Scenario: Software Deployment via SCCM/Intune
- Context: During mass software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, the deployment engine extracts installer packages to temporary directories (C:\Windows\CCMCache). These extraction processes often instantiate files matching XWorm IOCs as part of