The ThreatFox: KongTuke IOCs rule detects potential adversary activity linked to the KongTuke threat group, which is associated with high-severity malicious campaigns. SOC teams should proactively hunt for these indicators in Azure Sentinel to identify and mitigate advanced persistent threats before they cause significant damage.
IOC Summary
Malware Family: KongTuke Total IOCs: 20 IOC Types: url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://riihard.top/c | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://riihard.top/g | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://riihard.top/t | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://riihard.top/file.js | payload_delivery | 2026-05-11 | 100% |
| domain | riihard.top | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://gautter.lol/c | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://gautter.lol/g | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://gautter.lol/t | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://gautter.lol/file.js | payload_delivery | 2026-05-11 | 100% |
| domain | gautter.lol | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://chauvet.club/c | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://chauvet.club/g | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://chauvet.club/t | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://chauvet.club/file.js | payload_delivery | 2026-05-11 | 100% |
| domain | chauvet.club | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://olovier.lol/c | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://olovier.lol/g | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://olovier.lol/t | payload_delivery | 2026-05-11 | 100% |
| url | hxxps://olovier.lol/file.js | payload_delivery | 2026-05-11 | 100% |
| domain | olovier.lol | payload_delivery | 2026-05-11 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["riihard.top", "gautter.lol", "chauvet.club", "olovier.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://riihard.top/c", "https://riihard.top/g", "https://riihard.top/t", "https://riihard.top/file.js", "https://gautter.lol/c", "https://gautter.lol/g", "https://gautter.lol/t", "https://gautter.lol/file.js", "https://chauvet.club/c", "https://chauvet.club/g", "https://chauvet.club/t", "https://chauvet.club/file.js", "https://olovier.lol/c", "https://olovier.lol/g", "https://olovier.lol/t", "https://olovier.lol/file.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Scheduled System Backup Job
Description: A legitimate scheduled backup job uses a script that matches one of the KongTuke IOCs (e.g., a script named backup.sh that contains a string matching a known IOC).
Filter/Exclusion: process.name != "backup.sh" OR file.name != "backup.sh" OR process.parent.name == "systemd"
Scenario: Admin Task – User Account Management
Description: An admin is manually creating or modifying user accounts, and the command or script used contains a string that matches a KongTuke IOC (e.g., useradd -m user123 in a log entry).
Filter/Exclusion: process.name != "useradd" OR process.parent.name == "bash" OR user.name == "admin"
Scenario: Log Collection and Analysis Tool (e.g., Splunk, ELK)
Description: A log collection tool is parsing logs and the log line contains a string that matches a KongTuke IOC (e.g., an IP address or domain used in log messages).
Filter/Exclusion: process.name contains "splunk" OR process.name contains "logstash" OR process.parent.name contains "syslog"
Scenario: DevOps Pipeline Script Execution
Description: A CI/CD pipeline (e.g., Jenkins, GitLab CI) runs a script that includes a string matching a KongTuke IOC (e.g., a hardcoded IP in a deployment script).
Filter/Exclusion: process.name contains "jenkins" OR process.name contains "gitlab-runner" OR process.parent.name contains "docker"
Scenario: Network Monitoring Tool (e.g., Wireshark, tcpdump)
Description: A network monitoring tool captures traffic that includes