ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the DarkTortilla campaign by monitoring for specific indicators of compromise across network and endpoint logs within Azure Sentinel. Proactively hunting these IOCs is critical because early detection of this known threat actor allows the SOC team to rapidly isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`e63bc44fbf3dd02c91262e309fb4d0eb`	payload	2026-07-02	95%
sha256_hash	`51e3e006da49bddcdfaeceb3ada3b0401abc6e1536098caf85d3897a9e3e48e4`	payload	2026-07-02	95%
sha1_hash	`11758c6808e531b111b91997c67cb15a1e443032`	payload	2026-07-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["e63bc44fbf3dd02c91262e309fb4d0eb", "51e3e006da49bddcdfaeceb3ada3b0401abc6e1536098caf85d3897a9e3e48e4", "11758c6808e531b111b91997c67cb15a1e443032"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DarkTortilla IOCs rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Security Scanning of Quarantine Archives
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the “Quarantine” folder. This folder contains archived malware samples and historical threat intelligence feeds, including legacy DarkTortilla indicators that were previously ingested but not yet fully remediated in the SIEM. The scanner generates network traffic to these IOCs during its update cycle.
- Filter/Exclusion: Create a rule exclusion for processes running under the security vendor’s service account (e.g., svc_crowdstrike or LocalSystem) accessing specific internal file shares designated as “Threat Intelligence Repositories” (e.g., \\file-server\threat-intel\darktortilla).
IT Operations: Scheduled Patch Management Deployment
- Scenario: The IT operations team utilizes Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager to deploy a monthly security patch. This deployment package includes a specific update for the organization’s web proxy that references DarkTortilla IOCs in its configuration manifest. During the rollout, thousands of workstations simultaneously query these IOCs to validate certificate chains and update local blocklists.
- Filter/Exclusion: Exclude traffic originating from the SCCM site server IP range or the specific service account (svc_sccm_deployment) during the defined maintenance window (e.g., Sundays 02:00–06:00 UTC).
Security Operations Center (SOC) Threat Intel Ingestion
- Scenario: The SOC team runs a daily automated job using **