ThreatFox: Latrodectus IOCs

Hunt Hypothesis

This hunt targets adversary behavior linked to the Latrodectus threat actor by actively scanning Azure Sentinel logs against a curated set of 12 high-fidelity Indicators of Compromise (IOCs). Proactively executing this search is critical for the SOC team to identify early-stage intrusions and validate potential compromises before they escalate into significant incidents within the cloud environment.

IOC Summary

Malware Family: Latrodectus Total IOCs: 12 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Latrodectus
let malicious_domains = dynamic(["caramdistribuciones.com.ar", "cmla.blog", "cursohenfil.com.br", "cydesys.com", "dokonalebydleni.cz", "atlantadumpsterrentalhq.com", "baumas.no", "bringlearngrow.com", "artsunfold.com", "alianzaamericanaseguros.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Latrodectus
let malicious_urls = dynamic(["https://catholicsma.com/wp-content/uploads/2024/07/main.js", "https://asioklaydpory.com/h4r2.html"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Latrodectus

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Latrodectus IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Endpoint Protection Scans

  • Scenario: The organization’s scheduled nightly scan using CrowdStrike Falcon or Microsoft Defender for Endpoint triggers a deep heuristic analysis. During this process, the EDR agent generates temporary network connections to internal update servers that share IP ranges or domain hashes with known Latrodectus infrastructure (specifically those used for telemetry).
  • Filter/Exclusion: Create an exclusion rule based on the ProcessName of the security agent (e.g., C:\Program Files\CrowdStrike\fs.exe) combined with a time-based filter to exclude alerts occurring strictly between 02:00 and 04:00 UTC during maintenance windows.

• Software Deployment via Configuration Management

  • Scenario: The IT Operations team executes a mass deployment of the latest Adobe Creative Cloud suite using Microsoft System Center Configuration Manager (SCCM) or Ansible. The deployment agents establish outbound connections to specific content distribution points that match the Latrodectus IOCs, as these points host the installation packages and license verification services.
  • Filter/Exclusion: Exclude traffic originating from known SCCM management servers (e.g., SCCM-P01, SCCM-DP02) or Ansible controller IPs. Additionally, filter out connections where the destination port matches standard deployment protocols (e.g., TCP 8530 for SCCM) rather than generic web browsing ports.

• Automated Patch Management Jobs

  • Scenario: A recurring WSUS (Windows Server Update Services) synchronization job runs every Tuesday morning to pull updates from the vendor’s upstream repositories. The WSUS server initiates connections