ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt targets adversary activity involving seven specific indicators of compromise linked to the SmartApeSG campaign, which may manifest as anomalous network connections or file executions within the Azure environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection allows the SOC team to identify and contain potential lateral movement before it escalates into a widespread incident across cloud workloads.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 7 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["ivorysummit.top", "cobaltorchard.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://ivorysummit.top/router/status-sandbox.js", "https://ivorysummit.top/router/reset-fetch", "https://ivorysummit.top/router/verify-component.js", "https://cobaltorchard.top/router/reset-fetch", "https://cobaltorchard.top/router/verify-component.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Antivirus Definition Updates via WSUS

  • Scenario: The organization uses Microsoft Endpoint Configuration Manager (MECM) to push daily definition updates for Symantec Endpoint Protection. A specific hash within the SmartApeSG IOC list matches a known, benign component file (symcnet.dll) or a temporary update staging file generated during this scheduled deployment.
  • Filter/Exclusion: Exclude network traffic and file creation events originating from the internal WSUS server IP range (e.g., 10.20.50.0/24) where the destination process is mpexec.exe or Symantec Endpoint Protection.

• Third-Party Cloud Backup Agent Scans

  • Scenario: The enterprise utilizes Veeam Backup & Replication agents installed on file servers to perform incremental scans. One of the SmartApeSG IOCs corresponds to a legitimate certificate authority or a specific DLL used by Veeam’s communication module (VeeamAgent.exe) which is frequently accessed during backup windows.
  • Filter/Exclusion: Create an exclusion for processes named vbragent.exe and VeeamAgent.exe running under the local system account, specifically when accessing paths within the C:\Program Files\Veeam\Backup and Replication\ directory.

• Scheduled PowerShell Compliance Audits

  • Scenario: A nightly scheduled job runs a custom PowerShell script (ComplianceCheck.ps1) to audit user permissions against an internal GRC tool. This script downloads a reference JSON configuration file from an internal repository; the hash of this JSON file matches one of the SmartApeSG IO