ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt targets adversary activity involving seven specific indicators of compromise linked to the SmartApeSG campaign, which may signal early-stage reconnaissance or lateral movement within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify potential intrusions before they escalate, ensuring rapid containment and reducing the dwell time of known threats.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 7 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["coralfrontier.top", "linenharvest.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://coralfrontier.top/health/router-component.js", "https://coralfrontier.top/health/legacy-build", "https://coralfrontier.top/health/oauth-view.js", "https://linenharvest.top/health/legacy-build", "https://linenharvest.top/health/oauth-view.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: SmartApeSG IOCs detection rule in an enterprise environment:

• Enterprise Endpoint Security Scans: Legitimate scans performed by CrowdStrike Falcon or Microsoft Defender for Endpoint often query threat intelligence platforms to update their local IOC databases. If these agents actively pull the specific 7 SmartApeSG indicators (IP addresses, hashes, or domains) during a scheduled daily synchronization window, they may trigger the rule despite being benign administrative activity.

  • Suggested Filter: Create an exclusion based on the Source Host attribute to whitelist known security management servers and endpoint agents (e.g., Host_Name LIKE '%CrowdStrike%' OR Host_Name LIKE '%DefenderAgent%') during business hours (08:00–18:00).

• Scheduled Vulnerability Management Jobs: Automated vulnerability assessment tools like Tenable Nessus or Qualys Cloud Platform frequently execute scheduled scans that include external threat intelligence feeds. When these tools validate their asset inventory against the SmartApeSG IOC list as part of a “Threat Intelligence Correlation” job, they generate legitimate traffic matching the detection logic.

  • Suggested Filter: Exclude events where the Process Name matches known scanner executables (e.g., nessusd.exe, qualyspc.exe) and the Job ID corresponds to scheduled vulnerability assessment tasks defined in the CMDB.

• IT Helpdesk Ticketing System Updates: In environments using ServiceNow or Jira Service Management, automated workflows often trigger background jobs that fetch external threat data to enrich incident tickets. If a specific workflow is configured to ingest SmartApeSG IOCs to update ticket fields regarding “Active Threats,” the resulting network connections from the IT operations servers will appear as potential detections.

  • **Suggested