ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the DarkTortilla campaign by identifying specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these signatures is critical because DarkTortilla targets cloud infrastructure with sophisticated persistence mechanisms that may evade standard signature-based defenses until lateral movement occurs.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`68c9207a1e4e703b897300fc6c21cf0472549b352d80a64259e21ed4fdfe63a4`	payload	2026-07-16	95%
sha1_hash	`54f998f02bb83c71a0746cd38ca8203ed9a90a3a`	payload	2026-07-16	95%
md5_hash	`1f017ca7bcdae763c27483193017747a`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["68c9207a1e4e703b897300fc6c21cf0472549b352d80a64259e21ed4fdfe63a4", "54f998f02bb83c71a0746cd38ca8203ed9a90a3a", "1f017ca7bcdae763c27483193017747a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: DarkTortilla IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Signature Updates
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled daily update of its threat intelligence feeds. This process downloads and verifies the DarkTortilla IOCs (specifically known benign hash values used in training datasets) before deploying them to agents across the network, triggering the hunt package on the management server.
- Filter/Exclusion: Exclude traffic originating from the EDR management console IP range or filter events where the process name is FalconService.exe (CrowdStrike) or MsMpEng.exe (Defender) and the user context is a service account like svc-edr-updater.
SIEM Content Library Synchronization
- Scenario: The Security Information and Event Management (SIEM) platform, such as Splunk Enterprise Security or IBM QRadar, runs an automated nightly job to synchronize its external threat intelligence connectors. During this sync, the system ingests the DarkTortilla IOC feed from ThreatFox to enrich existing logs, causing a local scan of the IOCs against the SIEM’s internal index which matches the detection logic.
- Filter/Exclusion: Add an exclusion rule for events generated by the specific scheduled job name (e.g., ThreatIntel_Sync_Job) running under the system account siem-admin or originating from the SIEM indexer subnet.
Vulnerability Management Scanning
- Scenario: A vulnerability management tool like Tenable Nessus or Qualys Cloud Agent executes a weekly compliance scan against the corporate asset