ThreatFox: Tsunami IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Tsunami threat campaign by monitoring for specific Indicators of Compromise (IOCs) known to signal active reconnaissance or initial access attempts. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of Tsunami-related artifacts enables the SOC team to rapidly isolate affected assets and mitigate potential lateral movement before a full-scale breach occurs.

IOC Summary

Malware Family: Tsunami Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsunami
let malicious_ips = dynamic(["156.67.218.115", "151.106.52.209"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.67.218.115", "151.106.52.209"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsunami

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Tsunami IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Security Agent Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled daily definition update. This process downloads large signature packages from the vendor’s CDN, which may contain IP addresses or file hashes that overlap with Tsunami’s known benign IOCs.
  • Filter/Exclusion: Create an exclusion rule targeting the specific executable names of the security agents (e.g., C:\Program Files\CrowdStrike\fs.exe, MsMpEng.exe) and whitelist the vendor’s update server IP ranges in the threat intelligence feed configuration.

• Patch Management Deployment Jobs

  • Scenario: A scheduled Windows Server Update Services (WSUS) or SCCM task runs on a nightly basis to deploy critical security patches across the domain. The deployment agents connect to internal distribution points and external Microsoft content servers, generating network traffic that matches Tsunami’s “benign infrastructure” IOCs.
  • Filter/Exclusion: Exclude traffic originating from specific Active Directory Organizational Units (OUs) designated for patch management (e.g., OU=Patch-Management-Servers) or filter by the specific scheduled task name (e.g., Microsoft Windows Update Agent or Task Scheduler\SoftwareCenterDeployment).

• Cloud Backup and Data Replication

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault initiate routine data replication jobs to cloud storage providers (AWS S3, Azure Blob). These agents establish persistent connections to external endpoints that may be flagged by Tsunami as part of a broader “Tsunami” ecosystem or shared infrastructure.
  • **Filter/Ex