ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets the presence of known XWorm indicators of compromise, which are frequently used by threat actors to establish persistence and execute malicious payloads within Azure environments. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the worm can propagate laterally or exfiltrate sensitive data.

IOC Summary

Malware Family: XWorm Total IOCs: 13 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["162.217.248.219", "45.141.27.97", "143.92.51.33", "195.177.94.91", "31.6.50.206", "82.47.101.153"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.217.248.219", "45.141.27.97", "143.92.51.33", "195.177.94.91", "31.6.50.206", "82.47.101.153"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["tyyyy-50833.portmap.host", "jxjdhjdx-61930.portmap.host", "hb2grktsae.localto.net", "t2d2.ddns.net", "zogyjkdssr.localto.net", "8.tcp.cpolar.cn", "mail.qilantelecorn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Scenario: A DevOps engineer uses ansible or Terraform to provision new Linux servers, where the deployment scripts explicitly copy binary payloads or configuration files to /tmp or /var/tmp directories before moving them to their final locations.
  • Filter/Exclusion: Exclude alerts where the source process is ansible-playbook, terraform, or cloud-init and the destination path matches standard temporary directories (/tmp, /var/tmp) with a parent process of python or bash.
• Scenario: A system administrator performs a manual patching task using rsync or scp to transfer updated library files or application binaries to a staging server, which may involve writing to world-writable directories or using specific checksums that match XWorm IOCs.
  • Filter/Exclusion: Exclude events where the command line contains rsync or scp and the user belongs to the wheel or sudo group, provided the file size and hash match known internal artifact repositories.
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab CI) executes a build step that downloads dependencies from a private artifact registry and extracts them into a workspace directory, potentially triggering IOCs related to specific file names or paths used in the build environment.
  • Filter/Exclusion: Exclude alerts originating from processes named jenkins, gitlab-runner, or docker where the working directory is within the standard CI workspace paths (e.g., /var/lib/jenkins/workspace, /home/gitlab-runner/builds).
• Scenario: A security team runs a YARA scan or uses clamscan to audit existing files on a server, which may read or temporarily copy files to a quarantine directory, potentially matching IOCs if the scan tool itself or its temporary output paths align with XWorm signatures