ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity involving eight specific indicators of compromise linked to the SmartApeSG threat actor, which may signal targeted reconnaissance or initial access attempts within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this high-severity threat enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 8 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["amberobservatory.top", "copperlandmark.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://amberobservatory.top/public/scope-cookie.js", "https://amberobservatory.top/public/middleware-sessionstore", "https://amberobservatory.top/public/callback-asset.js", "https://copperlandmark.top/claims/redirect-state.js", "https://copperlandmark.top/claims/realm-fetch.js", "https://copperlandmark.top/claims/metrics-bundle"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: SmartApeSG IOCs detection rule in an enterprise environment:

• Legitimate Endpoint Management Scans: The deployment of security patches or software updates via tools like Microsoft Intune, Jamf Pro, or Ivanti Endpoint Manager often involves downloading and executing specific installer binaries. These installers may contain embedded libraries or network calls that match the SmartApeSG IOCs (e.g., specific hash values or domain connections used by the vendor’s update mechanism).

  • Suggested Filter/Exclusion: Create an exclusion rule for processes originating from known management service accounts (e.g., DOMAIN\IntuneAgentSvc) and restrict the alert to only trigger if the parent process is not a recognized enterprise deployment tool. Additionally, whitelist the specific SHA-256 hashes of the vendor’s update installer found in your software catalog.

• Scheduled Backup and Archiving Jobs: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik frequently run scheduled jobs that compress data and transfer it to cloud storage or on-premises repositories. The SmartApeSG IOCs may include file paths or network destinations (e.g., specific S3 buckets or Azure Blob endpoints) that these backup agents utilize for their routine operations, particularly during off-hours maintenance windows.

  • Suggested Filter/Exclusion: Implement a time-based exclusion to suppress alerts between 02:00 and 06:00 UTC (typical maintenance windows) for processes running under the SYSTEM or dedicated backup service accounts (e.g., DOMAIN\VeeamBackupSvc). Alternatively, add the specific destination IP ranges of your primary cloud storage providers to a whitelist.

• Third-Party SIEM and Log Forwarding Agents: Log collection agents like **Splunk Universal