ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis detects adversary activity linked to the XWorm malware by identifying network traffic and endpoint events matching six specific indicators of compromise (IOCs). The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify early-stage infections and prevent lateral movement before the worm propagates across the enterprise environment.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]76[.]49[.]76:7004`	botnet_cc	2026-08-05	75%
ip:port	`155[.]103[.]69[.]171:1122`	botnet_cc	2026-08-05	75%
ip:port	`104[.]128[.]191[.]103:8823`	botnet_cc	2026-08-05	75%
ip:port	`31[.]56[.]209[.]61:443`	botnet_cc	2026-08-05	75%
ip:port	`130[.]12[.]182[.]59:2026`	botnet_cc	2026-08-05	75%
ip:port	`185[.]215[.]151[.]120:8823`	botnet_cc	2026-08-05	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["80.76.49.76", "104.128.191.103", "155.103.69.171", "185.215.151.120", "31.56.209.61", "130.12.182.59"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["80.76.49.76", "104.128.191.103", "155.103.69.171", "185.215.151.120", "31.56.209.61", "130.12.182.59"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled deep scans on the “Quarantine” directory. This process often extracts and hashes archived malware samples previously identified as benign, triggering matches against XWorm IOCs that were once part of a historical threat campaign but are now safely stored in the quarantine vault.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from processes running under the C:\Program Files\CrowdStrike\FalconSensor\ or C:\Windows\System32\DefenderSvc.exe paths when the source file location is within a specific “Quarantine” or “Archive” directory (e.g., *\Quarantine\*).
IT Admin Manual Forensic Analysis
- Scenario: A Security Operations Center (SOC) analyst or IT administrator manually downloads known XWorm IOCs (such as specific hash values or domain names) from a threat intelligence feed into their local workstation to validate the detection logic. During this manual review, they extract files or ping domains, causing the local EDR agent on the admin machine to flag these legitimate actions as active threats.
- Filter/Exclusion: Exclude alerts generated by user accounts belonging to the IT-Security-Admins security group and restrict the scope to specific administrative workstations (e.g., hostname pattern ADM-WIN-*). Alternatively, add a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC).
Scheduled Threat Intelligence Feed Synchronization