The hunt hypothesis detects potential Vidar malware activity through suspicious network connections and file executions associated with known IoCs, indicating credential theft and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats before significant data loss occurs.
IOC Summary
Malware Family: Vidar Total IOCs: 15 IOC Types: url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | pvn.xybcaap.my.id | botnet_cc | 2026-05-12 | 100% |
| domain | ehj.chriskendall.media | botnet_cc | 2026-05-12 | 100% |
| domain | mpd.chriskendall.media | botnet_cc | 2026-05-12 | 100% |
| domain | wnm.chriskendall.media | botnet_cc | 2026-05-12 | 100% |
| url | hxxps://wnm.chriskendall.media/ | botnet_cc | 2026-05-12 | 100% |
| url | hxxps://ehj.chriskendall.media/ | botnet_cc | 2026-05-12 | 100% |
| url | hxxps://mpd.chriskendall.media/ | botnet_cc | 2026-05-12 | 100% |
| url | hxxps://dba.chriskendall.media/ | botnet_cc | 2026-05-12 | 100% |
| domain | dba.chriskendall.media | botnet_cc | 2026-05-12 | 100% |
| url | hxxps://dba.loniluekegerman.com/ | botnet_cc | 2026-05-11 | 100% |
| domain | dba.loniluekegerman.com | botnet_cc | 2026-05-11 | 100% |
| domain | brc.chriskendall.media | botnet_cc | 2026-05-11 | 100% |
| url | hxxps://brc.chriskendall.media/ | botnet_cc | 2026-05-11 | 100% |
| domain | mpd.pegasus-77.biz.id | botnet_cc | 2026-05-11 | 100% |
| url | hxxps://mpd.pegasus-77.biz.id/ | botnet_cc | 2026-05-11 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["pvn.xybcaap.my.id", "ehj.chriskendall.media", "mpd.chriskendall.media", "wnm.chriskendall.media", "dba.chriskendall.media", "dba.loniluekegerman.com", "brc.chriskendall.media", "mpd.pegasus-77.biz.id"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://wnm.chriskendall.media/", "https://ehj.chriskendall.media/", "https://mpd.chriskendall.media/", "https://dba.chriskendall.media/", "https://dba.loniluekegerman.com/", "https://brc.chriskendall.media/", "https://mpd.pegasus-77.biz.id/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Legitimate Scheduled Job Execution
Description: A scheduled job runs a script that uses a legitimate domain or URL similar to known Vidar IOCs, such as example.com or update.example.com.
Filter/Exclusion: process.name != "schtasks.exe" OR process.name != "task scheduler" or check for process.parent.name == "Windows Task Scheduler" and process.command_line contains "scheduled task".
Scenario: Admin Performing System Updates via PowerShell
Description: An administrator uses PowerShell to download and install updates from a trusted Microsoft server, which may trigger the rule due to similar URL patterns.
Filter/Exclusion: process.name != "powershell.exe" OR process.parent.name == "Windows Update" or check for process.command_line contains "Update.exe" or "wuauclt.exe".
Scenario: Legitimate Phishing Email Handling by Security Tools
Description: A security tool like Microsoft Defender for Endpoint or CrowdStrike processes a phishing email with a malicious link, which may be flagged as Vidar-related.
Filter/Exclusion: process.name contains "Microsoft Defender" OR process.name contains "CrowdStrike" OR check for process.command_line contains "phishing email analysis".
Scenario: Internal Monitoring Tool Using a Known IOC for Testing
Description: A tool like Splunk or ELK Stack is configured to use a known IOC for testing purposes, such as a test domain or IP address.
Filter/Exclusion: process.name contains "splunkd" OR process.name contains "elasticsearch" OR check for process.command_line contains "test IOC" or "test domain".
Scenario: Legitimate Software Deployment via Configuration Management
Description: A configuration management tool like **