ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity consistent with the SmartApeSG threat actor by identifying network connections and file artifacts matching three specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage intrusions and mitigate potential data exfiltration before lateral expansion occurs.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 3 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["alabastercompass.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://alabastercompass.top/public/refresh-cookie", "https://alabastercompass.top/public/throttle-sandbox.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios and suggested exclusions for the ThreatFox: SmartApeSG IOCs detection rule within an enterprise environment:

• Security Operations Center (SOC) Threat Intel Ingestion

  • Scenario: The Security Information and Event Management (SIEM) or Endpoint Detection and Response (EDR) management server periodically pulls the latest ThreatFox feed to update its internal threat intelligence database. This process involves downloading and parsing the specific SmartApeSG IOC list, triggering network connections to the IOCs as part of a validation handshake.
  • Suggested Filter: Exclude traffic originating from the IP addresses of the SIEM ingestion servers (e.g., Splunk Heavy Forwarders or CrowdStrike Management Nodes) where the destination port matches the standard ThreatFox API ports (typically 443).

• Automated Vulnerability Scanning and Patch Management

  • Scenario: Enterprise vulnerability scanners, such as Tenable Nessus or Qualys, are configured to perform deep-dive scans on critical assets. During a scheduled weekly scan, the scanner probes known malicious indicators (including SmartApeSG IOCs) against internal web servers to verify patch levels and configuration baselines, generating legitimate network flow logs that match the rule’s criteria.
  • Suggested Filter: Create an exclusion for source IPs belonging to the vulnerability management suite subnet and filter for specific user agents containing “Nessus,” “Qualys,” or “Tenable” in the HTTP headers during scheduled maintenance windows (e.g., Sundays 02:00–06:00 UTC).

• Software Supply Chain and Repository Synchronization

  • Scenario: Internal build servers running Jenkins or Azure DevOps pipelines execute a “Pre-Deployment Security Check” job. This job synchronizes with external artifact repositories (like JFrog Artifactory) that