ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior characterized by the propagation of XWorm malware through specific Indicators of Compromise (IOCs) that may evade standard signature-based defenses. Proactively searching for these IOCs in Azure Sentinel is critical to rapidly identify lateral movement and contain potential outbreaks before they compromise sensitive cloud workloads.

IOC Summary

Malware Family: XWorm Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04`	payload	2026-07-05	95%
sha1_hash	`96f4bf9096686fcb2cd171034b9ea22cd4da2280`	payload	2026-07-05	95%
md5_hash	`4b3c6ee4490da28af2ec40637384c400`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04", "96f4bf9096686fcb2cd171034b9ea22cd4da2280", "4b3c6ee4490da28af2ec40637384c400"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Endpoint Protection Scanning of Quarantine Repositories
- Scenario: The enterprise’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs scheduled deep scans on the “Quarantine” or “Sandboxed Files” directory. This directory often contains historical samples of known worms (including XWorm variants) used for training machine learning models or forensic analysis. When the EDR agent hashes these files, it triggers the detection logic against the stored IOCs.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from specific file paths designated as “Safe Analysis Zones” (e.g., C:\ProgramData\CrowdStrike\Quarantine or D:\Forensics\Samples). Additionally, filter out events where the process name is the EDR scanner itself (e.g., csagent.exe, MsMpEng.exe) rather than a user-facing application.
Automated Vulnerability Management Scans
- Scenario: The IT operations team runs weekly vulnerability assessments using tools like Tenable Nessus or Qualys. These scanners often deploy temporary agents that download and execute test binaries to verify patch levels. If the scanner’s internal library includes XWorm signatures for baseline comparison, the execution of these test binaries on a server (e.g., TenableAgent.exe running a specific vulnerability check script) will match the rule’s IOCs.
- Filter/Exclusion: Exclude alerts where the parent process is the vulnerability management agent (e.g., qualysPCSC.exe, Nessus.exe) and the source IP belongs to the internal “Scanning Infrastructure”