ThreatFox: GCleaner IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known malicious indicators from the GCleaner campaign, which typically target endpoints to establish persistence and exfiltrate sensitive data. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the malware can propagate laterally across the cloud infrastructure.

IOC Summary

Malware Family: GCleaner Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`7197e9097b977d138f3856a8aca3a3b3c6b28b82cc76a3667ef1364e820195cb`	payload	2026-07-10	95%
sha1_hash	`caceab5925bfda9eac39d24585f42db05071f531`	payload	2026-07-10	95%
md5_hash	`845a1bc9408c542cf748ba647c2e680e`	payload	2026-07-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["7197e9097b977d138f3856a8aca3a3b3c6b28b82cc76a3667ef1364e820195cb", "caceab5925bfda9eac39d24585f42db05071f531", "845a1bc9408c542cf748ba647c2e680e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GCleaner

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: GCleaner IOCs detection rule, tailored for an enterprise environment:

Enterprise Endpoint Protection Scanning
- Scenario: The organization’s primary endpoint security suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Program Files\GCleaner directory. During this process, the EDR agent generates network traffic and file integrity events matching the GCleaner IOCs as it validates the application binaries against its local threat intelligence feed.
- Filter/Exclusion: Create an exclusion rule to suppress alerts where the Process Name is CrowdStrike Falcon Sensor or MsMpEng.exe AND the Destination IP belongs to the internal EDR management server subnet (e.g., 10.20.50.x).
IT Administration Patch Deployment
- Scenario: The IT Operations team utilizes a configuration management tool like Ansible or SCCM (System Center Configuration Manager) to deploy a minor update patch for the GCleaner utility across 500 workstations. The deployment agent initiates connections to the GCleaner update servers and downloads signature files, triggering network flow detections that match the rule’s IOCs.
- Filter/Exclusion: Filter out events where the Source Host is a known patch management server (e.g., SCCM-Primary01) AND the User Account belongs to the IT-Admins security group, specifically during defined maintenance windows (e.g., Sundays 02:00–06:00 UTC).
Automated Log Rotation and Archiving
- Scenario: A scheduled PowerShell script named Daily_Log_Archive.ps1, running under the local system account (`NT AUTHORITY\SYSTEM