ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with XWorm, a malicious tool often used for initial access and lateral movement, by correlating specific network and host artifacts against Azure Sentinel telemetry. Proactively hunting for these IOCs is critical because XWorm is frequently deployed in targeted intrusions, allowing the SOC to identify early-stage footholds before adversaries escalate privileges or exfiltrate data.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["104.249.10.101", "188.212.158.34"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.249.10.101", "188.212.158.34"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Legacy Application Maintenance: A specific line-of-business application (e.g., an older ERP or CRM module) uses a custom C++ DLL that was compiled with an older version of the MinGW compiler, resulting in a PE header structure or import table entry that matches one of the XWorm IOCs.
  • Filter/Exclusion: Exclude the specific executable path (e.g., C:\Program Files\LegacyApp\bin\core.dll) or the specific SHA256 hash of the DLL from the IOC match criteria.
• Third-Party Utility Installation: An IT administrator installs a popular, legitimate system utility (such as a specific version of 7-Zip, WinRAR, or a network diagnostic tool like Wireshark or Nmap) that shares a common code signature or resource string with the XWorm sample due to similar open-source libraries or build environments.
  • Filter/Exclusion: Add an exclusion for the known-good vendor name (e.g., 7-Zip, WinRAR) or the specific file name (e.g., 7zFM.exe, WinRAR.exe) if the IOC is based on filename or resource strings.
• Scheduled Backup Job: A scheduled task running a backup agent (e.g., Veeam, Commvault, or a custom PowerShell script) writes temporary files to a specific directory (e.g., C:\Temp or C:\Users\Public) that match the XWorm IOC for file location or naming convention (e.g., files ending in .tmp or specific short names).
  • Filter/Exclusion: Exclude file paths under standard backup or temp directories (e.g., C:\ProgramData\BackupAgent\, C:\Temp\) or exclude processes known to be backup agents (e.g., VeeamBackup.exe, `commvaultagent.exe