ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Vidar malware family by searching for specific indicators of compromise known to facilitate credential theft and lateral movement within compromised networks. The SOC team should proactively execute this hunt in Azure Sentinel to identify early-stage infections that may have evaded initial perimeter defenses, ensuring rapid containment before sensitive data exfiltration occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 12 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["t10.psgiran.news", "t10.jangkarsm188.top", "gle.psgiran.news", "gle.jangkarsm188.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://t10.psgiran.news/", "https://t10.jangkarsm188.top/", "https://essentialnestshop.com/", "https://gle.jangkarsm188.top/", "https://gle.psgiran.news/", "https://ceebteologia.com.br/", "https://renwickgroup.com/", "https://sap.dev.rw.digital/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning of Known Malware Samples

  • Scenario: Security operations teams frequently download known malware samples (including historical Vidar variants) from repositories like VirusTotal or internal sandboxes to test EDR heuristics. When tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne scan these downloaded files, they may generate network connections or file hash matches that trigger the rule against the 12 Vidar IOCs.
  • Filter/Exclusion: Exclude traffic originating from specific “Security Lab” subnets (e.g., 10.50.20.0/24) and exclude processes running under known security service accounts (e.g., svc-crowdstrike, msdefender). Additionally, filter out events where the file hash matches a known benign sample ID in the internal asset inventory.

• Scheduled Antivirus Definition Updates

  • Scenario: The enterprise utilizes Symantec Endpoint Protection or Trend Micro Deep Security. During nightly scheduled jobs (e.g., running at 02:00 AM via Windows Task Scheduler), these agents pull the latest virus definition updates from their cloud repositories. If the update package contains signatures or telemetry related to the Vidar campaign, the agent’s communication with the vendor’s update servers may match the rule’s IOCs.
  • Filter/Exclusion: Create a time-based exclusion for events occurring between 01:00 and 04:00 local time on workstations. Furthermore, exclude network flows where the destination IP belongs to known antivirus vendor ranges (e.g., *.symantec.com, *.trendmicro.com) and the source process is identified