ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the KongTuke malware by actively searching for matches against eight specific Indicators of Compromise (IOCs) within Azure Sentinel logs. Proactively hunting for these IOCs is critical because it enables the SOC team to identify early-stage infections and lateral movement attempts before they escalate into full-scale incidents, thereby reducing dwell time in the environment.

IOC Summary

Malware Family: KongTuke Total IOCs: 8 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["tommy-or.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://ritchie.click/pvgdgpjx.js", "https://tommy-or.lol/f", "https://ritchie.click/ha1es146.js", "https://ritchie.click/mmaxs0rs.js", "https://ritchie.click/lkg91c5q.js", "https://ritchie.click/t4et81av.js", "https://ritchie.click/l46p3f8z.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for a legitimate enterprise environment:

• Software Vulnerability Scanning via Tenable Nessus

  • Scenario: The enterprise runs a scheduled nightly vulnerability scan using Tenable Nessus. During the scan, the agent on Windows endpoints executes a background process (nessusagent.exe) that queries external threat intelligence feeds. If KongTuke IOCs (specifically known benign domains or IP ranges used by software vendors) are part of the vendor’s update mechanism, the scanner may generate network connections to these IPs while downloading plugin definitions, triggering the detection despite being a standard maintenance activity.
  • Suggested Filter: Exclude traffic originating from the nessusagent.exe process hash or restrict the alert scope to exclude source ports associated with the Tenable management server (e.g., port 1005) during the defined maintenance window (02:00–04:00 UTC).

• Endpoint Protection Signature Updates via CrowdStrike Falcon

  • Scenario: The organization utilizes CrowdStrike Falcon for endpoint protection. The Falcon Sensor performs an automatic signature update every 6 hours, initiating outbound HTTPS connections to various content delivery networks (CDNs) and vendor repositories. If the KongTuke IOCs include IP addresses belonging to major cloud providers or software distributors that CrowdStrike uses as secondary mirrors, these routine update cycles will generate network logs matching the detection logic.
  • Suggested Filter: Create an exclusion rule for outbound connections from the Cortex.sys (CrowdStrike kernel driver) and FalconSensorService.exe processes to the specific IP ranges identified in the KongTuke IOC list, provided the destination port is 443.

• Microsoft 365 Compliance Data Archiving

  • Scenario: A