ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the KongTuke threat actor by actively scanning Azure Sentinel logs against a curated set of 13 Indicators of Compromise (IOCs). Proactively executing this search is critical to identify early-stage infections or lateral movement attempts that may have bypassed standard signature-based detections, ensuring rapid containment before the threat escalates.

IOC Summary

Malware Family: KongTuke Total IOCs: 13 IOC Types: url, ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
domain	g70jv5jnisaopa3.top	botnet_cc	2026-07-11	100%
domain	clkd3xc031atgdk.top	botnet_cc	2026-07-11	100%
domain	dht5z2yx50uypbr.top	botnet_cc	2026-07-11	100%
ip:port	64[.]95[.]13[.]85:80	botnet_cc	2026-07-11	75%
ip:port	64[.]95[.]13[.]85:443	botnet_cc	2026-07-11	75%
url	hxxps://leconto.lol/api/v1/status	payload_delivery	2026-07-11	100%
url	hxxps://cloudupdate8155.com/update/package	payload_delivery	2026-07-11	100%
domain	cloudupdate8155.com	payload_delivery	2026-07-11	100%
url	hxxps://thibahlt.lol/file.js	payload_delivery	2026-07-11	100%
domain	thibahlt.lol	payload_delivery	2026-07-11	100%
url	hxxps://thibahlt.lol/api/v1/session	payload_delivery	2026-07-11	100%
url	hxxps://thibahlt.lol/api/v1/verify	payload_delivery	2026-07-11	100%
url	hxxps://thibahlt.lol/api/v1/status	payload_delivery	2026-07-11	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - KongTuke
let malicious_ips = dynamic(["64.95.13.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.95.13.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["g70jv5jnisaopa3.top", "clkd3xc031atgdk.top", "dht5z2yx50uypbr.top", "cloudupdate8155.com", "thibahlt.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://leconto.lol/api/v1/status", "https://cloudupdate8155.com/update/package", "https://thibahlt.lol/file.js", "https://thibahlt.lol/api/v1/session", "https://thibahlt.lol/api/v1/verify", "https://thibahlt.lol/api/v1/status"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or SentinelOne, performs a scheduled deep scan of the C:\Quarantine directory. This process often unpacks archived threat samples containing KongTuke indicators for analysis, triggering file creation or network connection events that match the 13 IOCs without indicating an active infection on the host.
  • Filter/Exclusion: Create a rule exclusion for processes running under the EDR service account (e.g., svc_falcon or SentinelOneAgent) accessing paths containing \Quarantine\, \ThreatVault\, or specific vendor installation directories like \Program Files\CrowdStrike\.

• Security Information and Event Management (SIEM) Ingestion Jobs

  • Scenario: The central SIEM platform, such as Splunk Enterprise Security or Microsoft Sentinel, runs a nightly “Threat Intel Enrichment” scheduled job. This job downloads the latest KongTuke IOC feed from ThreatFox to update its local knowledge base, generating network traffic (HTTP/HTTPS) and file writes that match the detection logic but are purely administrative data ingestion tasks.
  • Filter/Exclusion: Exclude network connections originating from the SIEM indexer or collector servers (identified by specific hostnames like siem-col-01) targeting known ThreatFox API endpoints or internal threat intelligence repositories during maintenance windows (e.g., 02:00–04:00 UTC).

• Software Deployment and Patch Management Updates

  • Scenario: The IT Operations team utilizes