ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets the presence of XWorm malware indicators, which are frequently used for initial access and lateral movement within enterprise networks. Proactively searching for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, mitigating the risk of persistent backdoors and data exfiltration before the adversary can establish a foothold.

IOC Summary

Malware Family: XWorm Total IOCs: 5 IOC Types: sha1_hash, md5_hash, ip:port, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["13.143.66.14", "89.39.121.145"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["13.143.66.14", "89.39.121.145"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["553f13ad0daf5cc2897b177df386c40b12b83c581f7685131a52f30b48b37987", "3c4f65fe6f50dcf5e30eba42790637a660a45316", "483023803efafc86ee7c15151b0fe0e8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Legacy Application Dependency on XWorm-Derived Components: Some older, niche enterprise applications (e.g., specific versions of legacy point-of-sale systems or specialized industrial control software) may bundle a static library or helper executable that shares a hash or filename pattern with the XWorm IOCs due to shared compiler settings or reused codebases.

  • Filter/Exclusion: Exclude paths under specific application directories (e.g., C:\Program Files\LegacyPOS\bin\) and allow specific SHA-256 hashes if the file is verified as signed by the vendor.

• Security Tooling and Memory Dump Analysis: Security teams using tools like Volatility or WinDbg to analyze memory dumps from compromised hosts may inadvertently load XWorm-related modules or create temporary files matching IOC names during post-incident forensics.

  • Filter/Exclusion: Exclude processes initiated by known security tool executables (e.g., volatility.exe, windbg.exe) or files located in temporary forensic working directories (e.g., C:\Forensics\Temp\).

• Automated Patching and Software Deployment: Enterprise configuration management tools (e.g., SCCM, Ansible, or Chef) may deploy updates to third-party software that includes a component with a filename or hash matching an XWorm IOC, particularly if the vendor reuses build artifacts or if the IOC is based on a generic filename like update.exe or helper.dll.

  • Filter/Exclusion: Correlate with deployment logs to exclude files created by service accounts used for patching (e.g., svc_patch, admin_deploy) within a defined time window after a scheduled maintenance job.

• Virtual Machine and Sandbox Environments: In DevOps or testing environments, virtual machines or containers running legacy OS images or specific test suites may contain XWorm