ThreatFox: Kuiper IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known malicious indicators of compromise (IOCs) from the Kuiper threat intelligence feed, which often signal early-stage reconnaissance or lateral movement attempts within the network. Proactively hunting for these 22 specific IOCs in Azure Sentinel is critical to identify and contain potential threats before they escalate into significant incidents, leveraging high-fidelity external intelligence to reduce dwell time.

IOC Summary

Malware Family: Kuiper Total IOCs: 22 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	0b4bfd9422eb241b2d324cb69d65900b	payload	2026-07-10	95%
sha256_hash	9a42d843c5c0dd751898a0bec5a68d0fc097364788f99cdba6533b2f125b4a5f	payload	2026-07-10	95%
sha1_hash	ad76e4103136992aef4bba1d6f5518fec9255c51	payload	2026-07-10	95%
sha256_hash	56ca405fa5c12838051af41d5b515a3dc6064531eaabe635242d13e0e72de848	payload	2026-07-10	95%
sha1_hash	e4ef197da5354c0a2948f6a2f14104c587a9b385	payload	2026-07-10	95%
md5_hash	a1d1d914cd05bb1cbced378d002a44f9	payload	2026-07-10	95%
md5_hash	46a7d8d9303db9b9c5301b6d080088cc	payload	2026-07-10	95%
sha256_hash	81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e	payload	2026-07-10	95%
sha1_hash	27312667da1771cefb8880a0364d41ed056b59f0	payload	2026-07-10	95%
md5_hash	914f0b43128f5ede1083809ab35b144c	payload	2026-07-10	95%
sha256_hash	6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b	payload	2026-07-10	95%
sha1_hash	daa33e089ca3b9adbbf5bf3b12153c6323cd01d2	payload	2026-07-10	95%
md5_hash	e3ee9a97d742f50631e085a1ede54613	payload	2026-07-10	95%
sha256_hash	e32a3cc8a2a999af697bbfca1ab41f7605a593484d241da10d3fa6819c8c598b	payload	2026-07-10	95%
sha1_hash	3100edb0f59e934d64fc4f173ebe6b860ed0d0ab	payload	2026-07-10	95%
sha256_hash	aeb57ec14b5c7cf3b5ecf41bc4e783cd6a917ab56202404183ab42bd8bfed3d8	payload	2026-07-10	95%
sha1_hash	478d9285432671ef3f2672d4581ff7625f6f0708	payload	2026-07-10	95%
md5_hash	739d254907a3a933f0718634112582bb	payload	2026-07-10	95%
md5_hash	1b05bb4b7783efd8ac3e9d0ea2cd0254	payload	2026-07-10	95%
sha256_hash	1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d	payload	2026-07-10	95%
sha1_hash	9d1f8916a0a1b5379dc2138fb2ffc3b552d2285b	payload	2026-07-10	95%
md5_hash	9ab13dc4c79fdd894774735987c9b60e	payload	2026-07-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["0b4bfd9422eb241b2d324cb69d65900b", "9a42d843c5c0dd751898a0bec5a68d0fc097364788f99cdba6533b2f125b4a5f", "ad76e4103136992aef4bba1d6f5518fec9255c51", "56ca405fa5c12838051af41d5b515a3dc6064531eaabe635242d13e0e72de848", "e4ef197da5354c0a2948f6a2f14104c587a9b385", "a1d1d914cd05bb1cbced378d002a44f9", "46a7d8d9303db9b9c5301b6d080088cc", "81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e", "27312667da1771cefb8880a0364d41ed056b59f0", "914f0b43128f5ede1083809ab35b144c", "6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b", "daa33e089ca3b9adbbf5bf3b12153c6323cd01d2", "e3ee9a97d742f50631e085a1ede54613", "e32a3cc8a2a999af697bbfca1ab41f7605a593484d241da10d3fa6819c8c598b", "3100edb0f59e934d64fc4f173ebe6b860ed0d0ab", "aeb57ec14b5c7cf3b5ecf41bc4e783cd6a917ab56202404183ab42bd8bfed3d8", "478d9285432671ef3f2672d4581ff7625f6f0708", "739d254907a3a933f0718634112582bb", "1b05bb4b7783efd8ac3e9d0ea2cd0254", "1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d", "9d1f8916a0a1b5379dc2138fb2ffc3b552d2285b", "9ab13dc4c79fdd894774735987c9b60e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Kuiper

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment, along with targeted filtering strategies:

• Scheduled Vulnerability Scanning via Tenable Nessus

  • Scenario: The enterprise runs nightly vulnerability scans using Tenable Nessus. During these scans, the scanner actively probes external IP addresses and domains to validate asset reachability. If the scan configuration includes a “Web Browsing” or “HTTP/HTTPS” check against known threat intelligence feeds, it may generate traffic matching Kuiper IOCs (specifically those related to C2 beacons or reputation checks) as part of its standard discovery process.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts where the source IP belongs to the Tenable_Scanner asset group and the destination port is restricted to common scanning ports (e.g., 80, 443, 161). Additionally, filter out events occurring strictly within the scheduled maintenance window (e.g., Sunday 02:00 – 05:00 UTC).

• Automated Software Updates via Microsoft WSUS

  • Scenario: The organization utilizes Microsoft Windows Server Update Services (WSUS) to manage patching. When deploying critical updates for the Kuiper suite of applications or related security tools, the WSUS server initiates outbound connections to Microsoft update repositories and third-party vendor mirrors. These connections often traverse proxy servers that may log traffic matching Kuiper IOCs as they download manifest files or verify digital signatures against known threat intelligence endpoints.
  • Filter/Exclusion: Exclude alerts originating from the WSUS_Server subnet where the user agent string contains “Microsoft-Update” or “WindowsServerUpdateService.” Furthermore, filter based on specific HTTP status codes (200 OK) and file extensions (`.cab