ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the Vidar infostealer by actively searching for network and endpoint artifacts matching its seven known Indicators of Compromise (IOCs). Proactively hunting for these specific signals in Azure Sentinel is critical to identify early-stage infections before they exfiltrate sensitive credentials or financial data.

IOC Summary

Malware Family: Vidar Total IOCs: 7 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["faz.kataksm188.top", "faz.realmadridiran.news", "faz.jurangsm188.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://88.99.120.224", "https://faz.kataksm188.top/", "https://faz.realmadridiran.news/", "https://faz.jurangsm188.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Definition Updates via Windows Update

  • Scenario: The organization utilizes Microsoft Defender Antivirus, which frequently downloads and installs definition updates containing Vidar-related signatures. During the nightly update cycle (e.g., 02:00 AM), the MsMpEng.exe process generates network connections to Microsoft’s content delivery networks, triggering matches against Vidar IOCs embedded within the signature database files or telemetry endpoints.
  • Filter/Exclusion: Create an exclusion for processes originating from the path C:\Program Files\Windows Defender\MsMpEng.exe and restrict the rule trigger to exclude network traffic destined for Microsoft IP ranges (e.g., 13.107.*.*, 20.45.*.*) during standard maintenance windows.

• Endpoint Detection and Response (EDR) Telemetry Uploads

  • Scenario: The enterprise deploys CrowdStrike Falcon or SentinelOne, which maintains a local cache of threat intelligence feeds including Vidar indicators. When the EDR agent performs its scheduled daily “Threat Intelligence Sync” job, it establishes outbound HTTPS connections to the vendor’s cloud infrastructure (e.g., api.crowdstrike.com), causing the detection engine to flag these legitimate synchronization packets as potential Vidar IOCs.
  • Filter/Exclusion: Exclude traffic where the source process is the EDR agent executable (e.g., C:\Program Files\CrowdStrike\fs.exe or C:\Program Files\SentinelOne\SGAgent\sgagent.exe) and the destination domain contains known vendor intelligence endpoints.

• Software Deployment via Configuration Management Tools

  • Scenario: The