ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversary behavior characterized by the presence of specific XWorm indicators of compromise that signal active worm propagation and lateral movement within the network. Proactively hunting for these signatures in Azure Sentinel is critical to rapidly identify early-stage infections before they escalate into widespread outbreaks, thereby minimizing potential data exfiltration and operational downtime.

IOC Summary

Malware Family: XWorm Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`c4785f0696cae4e8630d28e545bbee207544e7e3`	payload	2026-07-10	95%
md5_hash	`6e66f889923ccb7dc34641a4d7ddc234`	payload	2026-07-10	95%
sha256_hash	`7ee796a8fef94d38a6ef3d906fe3d37052b5b6c2435420dcc75e459fbc501a68`	payload	2026-07-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["c4785f0696cae4e8630d28e545bbee207544e7e3", "6e66f889923ccb7dc34641a4d7ddc234", "7ee796a8fef94d38a6ef3d906fe3d37052b5b6c2435420dcc75e459fbc501a68"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scans on Legacy Servers
- Scenario: During off-hours maintenance windows, legacy file servers (e.g., Windows Server 2016) running older versions of Microsoft Defender Antivirus or CrowdStrike Falcon perform deep heuristic scans. These scans generate network traffic to known XWorm IOCs (specifically command-and-control domains) as part of their “Threat Intelligence Feed” synchronization, mimicking the worm’s initial beacon behavior.
- Filter/Exclusion: Create a whitelist rule excluding traffic originating from the Endpoint Protection service accounts (e.g., NT AUTHORITY\SYSTEM) or specific host groups tagged as “Legacy-Infra,” provided the destination ports match standard AV update ranges (443, 80) and the payload size aligns with known signature database updates rather than worm propagation scripts.
Scheduled Vulnerability Assessment Jobs
- Scenario: A weekly scheduled job running on a central management server using Tenable Nessus or Qualys Cloud Agent initiates active network probes against internal assets. These scanners actively resolve and connect to the XWorm IOCs listed in their threat intelligence database to verify certificate validity and port accessibility, triggering the “Hunt package for 3 IOCs” logic due to simultaneous connections from a single source IP.
- Filter/Exclusion: Exclude network flows where the source process is identified as nessus.exe, qualysagent.exe, or similar scanner binaries. Additionally, filter out events occurring strictly within the defined maintenance window (e.g., Sundays 02:00–06:00 UTC) for hosts belonging to the “Vulnerability-Scan-S