ThreatFox: Unknown Webinject IOCs

Hunt Hypothesis

Adversaries may be using unknown webinject IOCs to inject malicious code into user sessions and exfiltrate sensitive data. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential credential theft and data compromise campaigns.

IOC Summary

Malware Family: Unknown Webinject Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Webinject
let malicious_domains = dynamic(["marmelad.lat", "abrikos.xyz", "whynotebanarot.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Webinject

False Positive Guidance

• Scenario: Scheduled System Backup Using Webinject Tool
  Description: A legitimate scheduled backup job uses a webinject tool (e.g., webinject or webinject-cli) to inject a backup script into a web application for automated data retrieval.
  Filter/Exclusion: Exclude traffic originating from known backup systems or processes, e.g., process.name = "webinject" AND event.type = "scheduled_job" AND user.name = "backup_user"

• Scenario: Admin Task to Update Web Application Configuration
  Description: An administrator uses a webinject tool (e.g., webinject-cli) to update configuration files on a web server, which may involve injecting a script into the web application’s configuration.
  Filter/Exclusion: Exclude traffic where the source IP is an internal admin IP range, e.g., source.ip in ("10.0.0.0/8", "192.168.0.0/16") AND process.name = "webinject-cli"

• Scenario: CI/CD Pipeline Deploying Web Application with Injected Scripts
  Description: A CI/CD pipeline (e.g., Jenkins, GitLab CI) uses a webinject tool to inject a script during deployment to test or modify the web application’s behavior.
  Filter/Exclusion: Exclude traffic associated with CI/CD pipelines, e.g., process.name = "webinject" AND user.name = "ci_user" AND event.type = "deployment"

• Scenario: Internal Monitoring Tool Using Webinject for Data Collection
  Description: An internal monitoring tool (e.g., monitoring-agent) uses a webinject tool to inject a script into a web application for collecting performance metrics.
  Filter/Exclusion: Exclude traffic from known monitoring tools, e.g., `process.name = “monitoring-agent” OR process