ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by network traffic or endpoint activity matching five specific Indicators of Compromise (IOCs) linked to the XWorm malware family. Proactively hunting for these signatures in Azure Sentinel is critical because early detection of XWorm’s unique propagation patterns allows the SOC team to contain lateral movement before it compromises sensitive cloud workloads.

IOC Summary

Malware Family: XWorm Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["135.136.134.57", "217.60.195.12", "217.60.195.237", "217.60.195.213"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["135.136.134.57", "217.60.195.12", "217.60.195.237", "217.60.195.213"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["ultraportal.4nmn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Antivirus Definition Updates via Microsoft Endpoint Manager (Intune)

  • Scenario: The scheduled deployment of Windows Defender definition updates or third-party AV signatures (e.g., CrowdStrike, SentinelOne) often triggers network connections to known XWorm IOCs if the vendor’s update servers share IP ranges or DNS entries with historical worm infrastructure. This is common during the weekly Tuesday maintenance window where thousands of endpoints simultaneously reach out for signature patches.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from the “System” user account and specifically targeting the process MsMpEng.exe (Windows Defender) or the specific vendor’s update service executable, when communicating with the identified IOCs during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Automated Patch Management Jobs (SCCM/MECM)

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager runs scheduled “Software Update” tasks that download content from upstream repositories. If the enterprise utilizes a caching server or a specific CDN node for patch distribution, the IP address of this cache server may match an XWorm IOC. The detection triggers when the SCCM Client Service (ccmexec.exe) establishes connections to these IPs during the “Patch Tuesday” cycle.
  • Filter/Exclusion: Exclude alerts where the source process is ccmexec.exe and the destination IP matches the internal patch server subnet or specific CDN endpoints known to host update content, provided the traffic volume aligns with standard patch download sizes (e.g., >50MB) rather than small beaconing typical of worm propagation.

• **Cloud Backup and Replication Agents