ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the XWorm remote access Trojan to establish persistent backdoors and facilitate covert command-and-control communications through specific IP addresses. A proactive search within Azure Sentinel is essential to identify early-stage C2 traffic patterns that may evade standard signature-based detection, thereby preventing potential data exfiltration or lateral movement before full compromise occurs.

IOC Summary

Malware Family: XWorm Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`102[.]220[.]160[.]146:5050`	botnet_cc	2026-08-04	75%
ip:port	`217[.]60[.]195[.]87:443`	botnet_cc	2026-08-04	75%
ip:port	`84[.]38[.]133[.]132:6000`	botnet_cc	2026-08-04	75%
ip:port	`109[.]248[.]150[.]234:1012`	botnet_cc	2026-08-04	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["102.220.160.146", "217.60.195.87", "109.248.150.234", "84.38.133.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.146", "217.60.195.87", "109.248.150.234", "84.38.133.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise Endpoint Protection platforms (e.g., Microsoft Defender for Endpoint or CrowdStrike) frequently initiate background downloads of definition updates from vendor cloud repositories. These connections often utilize the same port ranges and IP patterns associated with XWorm’s C2 communication, triggering alerts during nightly maintenance windows.
- Filter/Exclusion: Create a time-based exclusion allowing traffic to known Vendor Update IPs (e.g., *.microsoft.com, *.crowdstrike.com) between 01:00 and 05:00 local time for the specific process MsMpEng.exe or csagent.exe.
Scenario: Automated Backup Agent Connectivity
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault agents regularly establish outbound connections to central management servers or cloud storage buckets (AWS S3, Azure Blob) for incremental data synchronization. These recurring sessions mimic the persistent backdoor behavior of XWorm.
- Filter/Exclusion: Exclude traffic originating from backup service processes (VeeamAgent.exe, commvault_service.exe) destined for internal backup server subnets or specific cloud storage IP ranges defined in the network topology.
Scenario: Remote Desktop and Management Tools
- Context: IT administrators utilize remote management tools such as TeamViewer, AnyDesk, or Microsoft System Center Configuration Manager (SCCM) to deploy patches and manage workstations. These tools maintain long-lived TCP connections for command execution that closely resemble the XWorm backdoor signature.
- Filter/Exclusion: Whitelist specific executable hashes for TeamViewer.exe, AnyDesk.exe,