ThreatFox: XWorm IOCs

Hunt Hypothesis

This detection identifies adversary activity linked to the XWorm malware by monitoring specific Indicators of Compromise (IOCs) that signal potential worm propagation and lateral movement within the network. A SOC team should proactively hunt for these signatures in Azure Sentinel to rapidly isolate infected endpoints and prevent widespread infection before the worm can exploit internal vulnerabilities.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["185.215.151.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.215.151.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["Pb3089EP3WAwzicHHzF9zQ=="]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

False Positive Scenarios for “ThreatFox: XWorm IOCs” Rule

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like Microsoft Defender for Endpoint or CrowdStrike Falcon frequently download and install definition updates during off-hours. These updates often contain hash signatures that overlap with known XWorm indicators, particularly if the XWorm signature was recently added to a shared threat intelligence feed used by the AV vendor.
  • Filter/Exclusion: Create an exclusion rule based on the process name of the update service (e.g., MsMpEng.exe or FalconSensorService) and restrict alerts to occur only outside the defined maintenance window (e.g., 02:00–04:00 UTC). Alternatively, exclude specific file paths where definition updates are cached (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates).

• Scenario: Automated Patch Management Deployment

  • Context: During routine patch cycles managed by tools like SCCM (System Center Configuration Manager) or Ivanti Neurons, the deployment agent pushes software updates that may include DLLs or executables with hashes matching XWorm IOCs. This is common when a vendor releases a security hotfix that aligns with the threat intelligence data used in the detection rule.
  • Filter/Exclusion: Implement a filter to suppress alerts originating from the specific service account running the patch deployment (e.g., DOMAIN\PatchServiceAccount) and exclude file paths within the standard software distribution directory (e.g., C:\Windows\CCM\Cache or D:\Ivanti\Deployment).

• Scenario: Cloud Backup Agent Scanning

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik run agents