ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets the presence of XWorm, a high-severity threat, by correlating 12 specific IOCs to identify compromised assets within the Azure Sentinel environment. Proactively hunting for these indicators is critical to detect and isolate active XWorm infections before they can establish persistence or execute lateral movement across the network.

IOC Summary

Malware Family: XWorm Total IOCs: 12 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["82.47.102.179", "85.203.4.161", "36.255.97.7", "85.203.4.222", "31.57.97.111", "82.22.62.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["82.47.102.179", "85.203.4.161", "36.255.97.7", "85.203.4.222", "31.57.97.111", "82.22.62.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["vla.tcptunnel.su", "Azx19-45876.portmap.host", "britsygomez90901002.duckdns.org", "tissues-carers.tun.ply.gg", "sddfgdqw45tj-35300.portmap.host", "lodalasan22wwee.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Legacy Application Maintenance: A deprecated internal reporting tool (e.g., LegacyReportGen.exe) is updated via a vendor patch that includes a new DLL or binary hash matching one of the XWorm IOCs. The application runs under a service account with limited privileges and is isolated in a DMZ segment.

  • Filter/Exclusion: Exclude alerts where the process path matches C:\Apps\LegacyReporting\* and the parent process is svchost.exe or a known service host, provided the file is signed by the vendor’s code-signing certificate.

• Third-Party Support Tooling: An IT support engineer uses a vendor-provided diagnostic utility (e.g., VendorDiagTool.exe) to troubleshoot a network issue. The tool downloads a helper component or temporary script that matches an XWorm IOC hash, but it is executed from a standard admin share (\\server\tools$\) and runs with a known admin account.

  • Filter/Exclusion: Exclude alerts where the process is launched from a mapped admin share path (e.g., \\*\tools$\) and the user belongs to the Domain Admins or IT Support security group, with the file location in a known tools directory.

• Scheduled Backup/Archival Job: A nightly scheduled task (BackupArchiveJob) copies large data files to an external NAS. During the copy process, a temporary file or checksum artifact is created that matches an XWorm IOC. The job runs under the BackupService account and is triggered by Task Scheduler with a known GUID.

  • Filter/Exclusion: Exclude alerts where the parent process is Task Scheduler (taskschd.msc or svchost.exe with Schedule service) and the user is BackupService, with the file path located in the designated backup staging area (e