ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by network connections to known XWorm indicators of compromise, signaling potential worm propagation or command-and-control activity within the environment. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly identify and contain early-stage infections before they spread laterally across critical assets.

IOC Summary

Malware Family: XWorm Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["207.180.29.217", "207.180.29.85"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.180.29.217", "207.180.29.85"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["biesmanscars.biz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, tailored for a legitimate enterprise environment:

• Antivirus Definition Updates via WSUS/SCCM

  • Scenario: The endpoint protection agent (e.g., Microsoft Defender or CrowdStrike) downloads updated virus definition packages from an internal WSUS server. These updates often contain embedded signatures and heuristic engines that match the specific IOCs associated with XWorm, triggering alerts during the nightly update cycle across the domain controller group.
  • Filter/Exclusion: Create a rule exclusion for network traffic originating from the internal WSUS IP range (e.g., 10.x.x.x) destined for the AV management console ports, or exclude file hashes known to belong to the specific AV vendor’s update package manifest.

• Scheduled Enterprise Backup Jobs

  • Scenario: A nightly scheduled backup job using Veeam Backup & Replication scans and archives critical database files (SQL Server) on a production server. The backup software utilizes a compression engine that generates temporary files containing metadata patterns identical to the XWorm IOCs, causing the detection logic to flag these legitimate I/O operations as suspicious activity.
  • Filter/Exclusion: Exclude alerts generated by the specific service account running the backup agent (e.g., svc-veeam-backup) or filter out file paths located within the designated backup staging directory (e.g., D:\Veeam\BackupStaging\*).

• Software Deployment via Configuration Management

  • Scenario: An automated deployment task using Ansible or Puppet pushes a new application patch to a fleet of web servers. The deployment script extracts a compressed archive containing third-party libraries that include the XWorm IOCs as part of their standard dependency chain, triggering the rule during the “unpack” phase of the installation process.