ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the KongTuke threat by identifying matches against eight specific Indicators of Compromise (IOCs) within network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of KongTuke’s unique signatures allows the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: KongTuke Total IOCs: 8 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://schuctz.click/ps8oyg4x.js", "https://schuctz.click/epx4vn8q.js", "https://schuctz.click/wvjn3nb0.js", "https://schuctz.click/e187jn2e.js", "https://schuctz.click/h5gqnaud.js", "https://schuctz.click/xyzqcsdc.js", "https://schuctz.click/kkikc54m.js", "https://schuctz.click/2xfae91q.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: KongTuke IOCs detection rule in an enterprise environment:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, frequently scan large quarantine archives or backup repositories. These archives often contain historical malware samples from previous incidents (including KongTuke variants) used for training or forensic analysis. When the EDR scans these files, it triggers a match against the active IOCs even though no live infection exists on the host.
  • Suggested Filter: Exclude file paths located within designated quarantine directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine or specific CrowdStrike “Hold” folders) and filter for processes running under the EDR service account (e.g., svc-crowdstrike or LocalSystem) rather than interactive user sessions.

• Automated Vulnerability Scanning with Signature Updates

  • Scenario: Scheduled vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM perform periodic scans across the network. During these scans, agents download and cache updated threat intelligence feeds or signature databases which may include KongTuke indicators as reference objects. The scanning agent’s temporary file creation process generates IOCs that mimic active threats but are part of a routine maintenance window.
  • Suggested Filter: Create an exclusion for the specific service accounts used by these scanners (e.g., svc-tenable-agent, QualysAgent) and restrict alerts to business hours or exclude events occurring during known scheduled scan windows defined in the IT calendar.

• Software Deployment via Configuration Management

  • Scenario: During routine patch management cycles, tools like **Microsoft