ThreatFox: HijackLoader IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the HijackLoader dropper to establish persistence and execute malicious payloads through known indicators of compromise within the Azure Sentinel environment. Proactive hunting for these specific IOCs is critical because HijackLoader often serves as an initial foothold for advanced threats, allowing the SOC team to detect early-stage infections before they escalate into broader lateral movement or data exfiltration campaigns.

IOC Summary

Malware Family: HijackLoader Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`72344facd02bea9007c59c2a67bd96d521838b566298caf0f80c6ceecf93520f`	payload	2026-07-18	95%
sha1_hash	`fb7cd49f47060a8514fe5c358bb2a9f74eb215f4`	payload	2026-07-18	95%
md5_hash	`f238406f5cd53942450f145e1c977476`	payload	2026-07-18	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - HijackLoader
let malicious_hashes = dynamic(["72344facd02bea9007c59c2a67bd96d521838b566298caf0f80c6ceecf93520f", "fb7cd49f47060a8514fe5c358bb2a9f74eb215f4", "f238406f5cd53942450f145e1c977476"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — HijackLoader

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: HijackLoader IOCs rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Agent Updates via Microsoft Endpoint Configuration Manager (MECM)
- Scenario: The organization uses MECM to push security updates. During a scheduled maintenance window, the agent downloads and executes the HijackLoader update package, which includes the specific IOCs (e.g., known hash of the installer or network beacon) as part of its legitimate installation routine.
- Filter/Exclusion: Create an exclusion for processes originating from the C:\Program Files\Microsoft Configuration Manager\ directory or specifically target the executable path ccmexec.exe when it spawns child processes matching the HijackLoader IOCs during defined maintenance windows (e.g., 02:00–04:00 UTC).
Automated Patch Management via Ivanti or SCCM
- Scenario: A scheduled job runs Ivanti Patch Manager to deploy a critical security patch for the HijackLoader software suite. The deployment script temporarily downloads the IOCs to a local staging folder (C:\Temp\PatchStaging) before execution, triggering the network and file hash detections.
- Filter/Exclusion: Exclude file paths containing \Ivanti\ or C:\Temp\PatchStaging\ in the detection logic. Additionally, filter out events where the parent process is identified as PatchAgent.exe or SCCMClient.exe.
IT Admin Manual Remediation Scripts
- Scenario: An IT administrator manually runs a PowerShell script (Invoke-HijackUpdate.ps1) on a specific set of workstations to remediate a known vulnerability. The script explicitly downloads the HijackLoader IOCs from an internal artifact repository (e.g