ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where XWorm leverages compromised credentials and unpatched systems to propagate laterally across network segments. Proactive hunting in Azure Sentinel is critical to identify early-stage lateral movement and contain rapid worm-like spread before it compromises the broader environment.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["91.219.238.82", "147.124.212.143"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.219.238.82", "147.124.212.143"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, tailored to a legitimate enterprise environment:

• Scheduled Antivirus Definition Updates via WSUS

  • Scenario: The Windows Server Update Services (WSUS) server pushes daily definition updates to all endpoints. This process often triggers lateral network scans and file integrity checks that mimic XWorm’s propagation behavior, especially when the update service connects to multiple internal repositories simultaneously.
  • Filter/Exclusion: Create a rule exclusion for traffic originating from the WSUS server IP (e.g., 10.20.5.1) destined for client ports 8530-8531, or exclude the specific hash of the update payload if it matches known Microsoft signature IDs.

• Enterprise Backup Jobs Using Veeam or Commvault

  • Scenario: During nightly backup windows, agents (e.g., Veeam Agent for Windows) perform full volume scans and replicate data across subnets to a central repository. This high-volume lateral file movement and credential usage can be misidentified as XWorm spreading laterally via compromised credentials.
  • Filter/Exclusion: Exclude traffic generated by the backup service account (e.g., svc_backup_admin) running on specific backup proxy servers, or filter out connections where the source process is VeeamAgent.exe or commvault_agent.exe.

• Active Directory Group Policy Object (GPO) Enforcement

  • Scenario: When a new GPO containing scripts or software deployment packages is pushed, Domain Controllers initiate lateral communication to enforce policies on member servers. This involves authenticating against multiple hosts and deploying files, which aligns with XWorm’s “compromised credentials” detection logic.
  • Filter/Exclusion: Exclude events where the source process is `