ThreatFox: Vjw0rm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known Vjw0rm indicators across endpoints to identify early-stage worm propagation and lateral movement attempts. Proactively hunting for these specific IOCs in Azure Sentinel is critical because it enables the SOC team to detect and contain this high-severity threat before it establishes persistence or spreads widely within the cloud infrastructure.

IOC Summary

Malware Family: Vjw0rm Total IOCs: 5 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	`solucionesfiscales.store`	payload_delivery	2026-07-17	100%
domain	`colombiajudiciales.store`	payload_delivery	2026-07-17	100%
domain	`solicitudesinternas.store`	payload_delivery	2026-07-17	100%
domain	`comunicacioones.store`	payload_delivery	2026-07-17	100%
domain	`ccleanerupdate.mysynology.net`	botnet_cc	2026-07-17	75%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vjw0rm
let malicious_domains = dynamic(["solucionesfiscales.store", "colombiajudiciales.store", "solicitudesinternas.store", "comunicacioones.store", "ccleanerupdate.mysynology.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Vjw0rm

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vjw0rm IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Policy Updates via Microsoft Defender for Endpoint
- Scenario: The Security Operations team pushes a global policy update containing new threat intelligence signatures. During this rollout, the MsMpEng.exe process on thousands of endpoints downloads and executes signature definition files that match one of the Vjw0rm hash IOCs (specifically a shared library component used in multiple AV vendors’ definitions).
- Filter/Exclusion: Create an exclusion rule for the MsMpEng.exe process path (C:\Program Files\Windows Defender\MsMpEng.exe) and exclude network connections originating from the Microsoft Update content delivery network IP ranges (e.g., 13.107.*.*, 23.46.*.*).
Automated Software Deployment via SCCM/MECM
- Scenario: A scheduled nightly job managed by System Center Configuration Manager (SCCM) deploys a critical patch for the organization’s internal document management system. The deployment package includes a pre-compiled installer (setup.exe) that embeds a known good DLL, which happens to share an identical SHA256 hash with one of the Vjw0rm IOCs due to a common open-source dependency (e.g., a specific version of OpenSSL or a logging library).
- Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe or ApplicationHost.exe running under the context of the “System” account, and specifically filter out file hashes that are already present in the organization’s internal “Whitelisted Software Inventory” database.
IT Admin Manual Remediation Scripts
- Scenario: An IT administrator manually runs a PowerShell remediation script (`Invoke-