ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known XWorm indicators of compromise (IOCs) that signal active worm propagation and potential lateral movement within the network. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify early-stage infections, isolate affected endpoints before widespread replication occurs, and mitigate the risk of critical infrastructure disruption.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["46.151.182.234"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.151.182.234"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["imobilityes.cabvlliahermosa.com.mx"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: XWorm IOCs rule in an enterprise environment:

• Antivirus Engine Updates via Scheduled Tasks

  • Scenario: The organization uses Microsoft Defender Antivirus or Symantec Endpoint Protection. A nightly scheduled task (e.g., Task Scheduler job named “AV Definition Update”) connects to the vendor’s update servers to download definition signatures. These signature files often contain hashes that overlap with XWorm IOCs, triggering the rule during the maintenance window.
  • Filter/Exclusion: Exclude traffic originating from the specific hostnames of the AV vendor (e.g., *.microsoft.com, *.symantec.com) or filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 UTC) where the source process is MsMpEng.exe or SymantecEngine.exe.

• Enterprise Backup and Archive Operations

  • Scenario: The IT team utilizes Veeam Backup & Replication to perform incremental backups of critical file servers. During the backup cycle, the Veeam service (vbrservice.exe) scans large archives (.vbk, .zip) which may contain embedded hashes matching XWorm indicators. This is common when backing up legacy data repositories that include older documents with similar cryptographic signatures.
  • Filter/Exclusion: Create an exclusion rule for the specific backup service process (vbrservice.exe or VeeamAgent.exe) and restrict the scope to the dedicated backup subnet (e.g., 10.20.50.x). Additionally, exclude file extensions commonly used in archives like .vbk, .tar.gz, and .7z.

• Software Deployment via Configuration Management

  • Scenario: The DevOps team