ThreatFox: Tofsee IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the Tofsee threat actor by identifying specific Indicators of Compromise (IOCs) that signal potential reconnaissance or initial access attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of Tofsee’s unique signatures allows the SOC team to isolate affected assets before lateral movement occurs, thereby reducing dwell time and mitigating high-severity risks associated with this known threat group.

IOC Summary

Malware Family: Tofsee Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tofsee
let malicious_ips = dynamic(["157.20.182.81", "196.251.121.90"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.20.182.81", "196.251.121.90"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tofsee

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Tofsee IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Security Information and Event Management (SIEM) Ingestion of Threat Intelligence Feeds

  • Scenario: The organization’s SIEM platform (e.g., Splunk or Microsoft Sentinel) ingests daily threat intelligence feeds from a third-party provider that includes the Tofsee family hash signatures. When the ingestion pipeline processes these CSV/JSON files, the file hashes match the Tofsee IOCs within the detection logic, triggering an alert despite no actual endpoint infection occurring on user workstations.
  • Filter/Exclusion: Exclude events where the Source Host or Ingesting Service is identified as the SIEM collector itself (e.g., hostname starts with SIEM-Collector-*) and the Event Type is “File Ingestion” rather than “Endpoint Execution.”

• Scheduled Antivirus Definition Updates via WSUS

  • Scenario: During a weekly maintenance window, the Windows Server Update Services (WSUS) server pushes updated virus definition packages to domain controllers. The update package contains the Tofsee signature database files. As these files are extracted and verified by the local antivirus engine (e.g., CrowdStrike or Symantec Endpoint Protection), they generate file creation events matching the 3 specific IOCs, mimicking a potential infection scan.
  • Filter/Exclusion: Create an exclusion rule for processes running under the SYSTEM account during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC) where the Parent Process Name is wsusclient.exe or the specific AV update service executable.

• Endpoint Detection and Response (EDR) Baseline Scans

  • Scenario: The