ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the KongTuke malware by monitoring for specific indicators of compromise across the Azure Sentinel environment. Proactively hunting these IOCs is critical because early identification of this high-severity threat enables rapid containment before the malware can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: KongTuke Total IOCs: 10 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["leannnn.lol", "farrerl.lol", "tommy-y.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://leannnn.lol/file.js", "https://leannnn.lol/api/v1/session", "https://leannnn.lol/api/v1/verify", "https://farrerl.lol/file.js", "https://farrerl.lol/api/v1/session", "https://farrerl.lol/api/v1/verify", "https://tommy-y.lol/o"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a deep scan of the “Quarantine” folder on file servers. This folder contains archived logs and decompressed software installers that include legitimate files matching KongTuke IOCs (e.g., specific DLLs or executable hashes) previously flagged during vendor updates but not yet removed from the network.
  • Suggested Filter: Exclude alerts where the Source Process is the EDR scanner service (e.g., C:\Program Files\CrowdStrike\fs.exe) AND the File Path contains keywords like \Quarantine\, \Archive\, or \Staging\.

• Scheduled Third-Party Patch Management Deployment

  • Scenario: The IT Operations team utilizes Ivanti Patch Manager (or SCCM/MECM) to deploy a scheduled weekly update for the organization’s development tools. This deployment package includes a KongTuke-related software component or library that triggers the IOC detection on multiple workstations simultaneously during the “Deployment Window” (e.g., Saturdays between 02:00 and 04:00 UTC).
  • Suggested Filter: Create an exclusion rule for alerts occurring between Saturday 01:00 and Sunday 06:00 where the Parent Process Name is IvantiPatchAgent.exe or ccmexec.exe, and the User Account belongs to the IT-Service-Accounts security group.

• **SIEM Log In