ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known malicious indicators from the GCleaner campaign to identify potential compromise within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate affected assets before the malware can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`fb1566a75cbb2034b53b31474ab4d21a7caea50e`	payload	2026-07-05	95%
md5_hash	`27af4194b3fb1179eca9bb2ebd511a12`	payload	2026-07-05	95%
sha256_hash	`65736a4315b49718b68e1a72d24ff61e1b0537f2c2deb19f5bb339f2aa10e459`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["fb1566a75cbb2034b53b31474ab4d21a7caea50e", "27af4194b3fb1179eca9bb2ebd511a12", "65736a4315b49718b68e1a72d24ff61e1b0537f2c2deb19f5bb339f2aa10e459"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: GCleaner IOCs detection rule in an enterprise environment:

Scheduled Enterprise Antivirus Updates
- Scenario: The organization’s endpoint protection platform (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs a scheduled nightly update. During this process, the AV engine downloads and installs new definition signatures that include GCleaner components to patch known vulnerabilities in the cleaning utility itself. This triggers the IOCs as “new” activity on workstations and servers.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (e.g., CSPService.exe, SentinelOneAgent.exe) and Parent Process being the OS Update Service (usocoreworker.exe or svchost.exe). Additionally, exclude traffic originating from the vendor’s update distribution servers (e.g., *.crowdstrike.com, *.microsoft.com).
IT Admin Deployment via Configuration Management Tools
- Scenario: A System Administrator uses a configuration management tool like Ansible, Chef, or SCCM (System Center Configuration Manager) to push a mandatory GCleaner patch across the domain. The deployment agent executes the installer (setup.exe) and registers new services, generating network connections and file creation events that match the three specific IOCs associated with GCleaner.
- Filter/Exclusion: Exclude alerts where the Initiating User is a known service account (e.g., svc_ansible_deploy, SCCM_ADMIN) or belongs to the “IT_Operations” security group. Furthermore, filter by Source IP ranges corresponding to the internal configuration management servers.
Automated Disk Cleanup and Maintenance Jobs
- Scenario: A scheduled Task Scheduler job (