ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known XWorm indicators, which are frequently used to establish initial footholds and propagate malware across enterprise networks. A SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify early-stage infections and prevent lateral movement before the worm compromises critical assets.

IOC Summary

Malware Family: XWorm Total IOCs: 8 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["31.56.209.60", "104.249.10.95"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.56.209.60", "104.249.10.95"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["windowsupdate.webhop.me", "barikadeuku.freedev.app", "without.kesug.com", "tagmentos.bingbaochow.cam", "haghuer.bingbaochow.cam", "technocalfindersda.bounceme.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Antivirus Engine Signature Updates

  • Scenario: The endpoint protection suite (e.g., Microsoft Defender Antivirus or CrowdStrike Falcon) automatically downloads and applies new definition updates. These updates often contain hash values that match the XWorm IOCs, triggering alerts when the update service (MpCmdRun.exe or csfalcon.exe) accesses the network to fetch signatures from vendor cloud repositories.
  • Filter/Exclusion: Create a process-based exclusion for the specific AV engine processes (e.g., Microsoft Defender Antivirus Service, CrowdStrike Falcon Sensor) and exclude network destinations matching the vendor’s update server IP ranges or domains (e.g., *.microsoft.com, *.crowdstrike.com).

• Scheduled Enterprise Backup Jobs

  • Scenario: Nightly backup agents (such as Veeam Agent, Commvault, or Rubrik) perform full scans of file shares and databases. During the indexing phase, these agents generate network traffic and process hashes that may overlap with XWorm IOCs, particularly if the backup software uses similar cryptographic algorithms or connects to known cloud storage endpoints included in the IOC list.
  • Filter/Exclusion: Exclude alerts generated by specific backup service accounts (e.g., DOMAIN\BackupSvc) running on designated backup server hosts during their defined maintenance windows (e.g., 02:00–06:00 UTC). Additionally, exclude traffic destined for the organization’s internal backup repository IP subnets.

• Software Deployment via Configuration Management

  • Scenario: Automated patching and software deployment tools like Microsoft SCCM (Configuration Manager) or Ansible Tower push updates to endpoints. The deployment agents often download