ThreatFox: Ave Maria IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the execution or communication of known Ave Maria indicators of compromise (IOCs) to detect potential post-exploitation activities within the environment. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel to identify early-stage infections and validate the efficacy of existing threat intelligence feeds against this high-severity campaign.

IOC Summary

Malware Family: Ave Maria Total IOCs: 7 IOC Types: sha1_hash, sha256_hash, md5_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ave Maria
let malicious_ips = dynamic(["217.60.195.56"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.195.56"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ave Maria
let malicious_hashes = dynamic(["b1341da78ca16f4d04cb56d05c63a821", "14b7d8e98b8cd97f8f302bab2b4dea27", "0911748a95f6a362d1ed8d6fcd1a7889167520cdd506522658d84a69c9a088ab", "2a43e2b7dea9979a803c300b5b9638f5d4ae2f64", "83a2d5361b91b0ac26ff7c5f161dd3008de6922c5df7f8c0af80b1dea105480d", "af09bf91db9bb8dfaa56f1d2e3d4fab97e6fdf72"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Ave Maria

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Ave Maria IOCs detection rule, tailored for an enterprise environment:

• Scheduled Vulnerability Scans by Qualys or Tenable

  • Scenario: Enterprise vulnerability management platforms (e.g., Qualys Cloud Agent or Tenable Nessus) frequently scan internal assets using their own proprietary update servers. If the Ave Maria IOC list includes IP addresses or domains that overlap with these vendor infrastructure endpoints, routine daily scans will trigger alerts when agents check for updates or report status back to the cloud console.
  • Filter/Exclusion: Create an exclusion rule based on the Source Process Name (e.g., qualyspc.exe, TenableAgent.exe) and restrict the alert scope to known internal IP subnets where these agents are deployed, excluding traffic originating from the specific vendor update gateways.

• Microsoft Defender for Endpoint (MDE) Telemetry and Cloud Sync

  • Scenario: When MDE is configured with “Cloud-delivered protection” or “Tamper Protection,” it communicates constantly with Microsoft’s cloud infrastructure to fetch threat intelligence updates. If the Ave Maria IOCs include generic Microsoft content delivery network (CDN) endpoints or specific Azure storage blobs used for definition downloads, legitimate background synchronization tasks will generate high-volume false positives during peak update windows.
  • Filter/Exclusion: Exclude traffic where the Destination Domain matches known Microsoft CDN patterns (e.g., .azureedge.net, .windowsupdate.com) and the Process Path corresponds to the MDE service (MsMpEng.exe or SenseClientService.exe).

• Automated Patch Management via SCCM or Intune

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Intune often pushes large definition updates or security patches during scheduled maintenance windows. If the Ave Maria IOCs contain URLs