ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt targets adversary activity involving four specific indicators of compromise linked to the SmartApeSG threat actor, which may signal reconnaissance or initial access attempts within our environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate affected assets and mitigate potential lateral movement before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 4 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["pearlgallery.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://pearlgallery.top/reset/user-ajax.js", "https://pearlgallery.top/reset/refresh-util", "https://pearlgallery.top/reset/principal-response.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Updates via Vendor Repository

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) automatically downloads and executes signature updates from the SmartApeSG vendor repository. These legitimate update packages often contain the same hashes or network destinations identified as IOCs within the ThreatFox feed, triggering alerts during nightly maintenance windows.
  • Suggested Filter: Exclude traffic originating from known Endpoint Management Server IPs (e.g., 10.20.50.x range) destined for the specific SmartApeSG update URLs or IP ranges defined in the vendor’s “Trusted Sources” documentation. Additionally, whitelist process paths matching the standard agent updater executable (e.g., C:\Program Files\CrowdStrike\FalconSensor\CSFalconService.exe).

• Scheduled Threat Intelligence Feed Ingestion Job

  • Scenario: A centralized Security Information and Event Management (SIEM) or a dedicated threat intelligence platform (like Tenable.io or Recorded Future) runs a scheduled PowerShell script every morning at 08:00 to ingest external IOCs. This job explicitly queries the SmartApeSG API endpoints to refresh its local database, generating network connections and file downloads that match the rule’s detection logic for “IOCs associated with SmartApeSG.”
  • Suggested Filter: Create an exclusion based on the scheduled task name (e.g., TaskName: DailyThreatFeedSync) running under a dedicated service account (e.g., svc_threat_intel). Alternatively, filter out events where the source process is the specific script runner (e