ThreatFox: BADBOX IOCs

Hunt Hypothesis

This hunt targets adversary behavior consistent with the BADBOX malware campaign by actively searching for network and endpoint artifacts matching its specific set of eleven Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage infections before they escalate, ensuring rapid containment of this high-severity threat across the organization’s cloud infrastructure.

IOC Summary

Malware Family: BADBOX Total IOCs: 11 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - BADBOX
let malicious_ips = dynamic(["144.217.243.201", "165.154.202.29", "98.98.71.20", "172.96.114.6", "98.98.71.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.217.243.201", "165.154.202.29", "98.98.71.20", "172.96.114.6", "98.98.71.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - BADBOX
let malicious_domains = dynamic(["a1.ishano456.sbs", "t1.ishano456.sbs", "a1.xmsae.sbs", "t1.xmsae.sbs", "a1.xshaon123.sbs", "t1.xshaon123.sbs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — BADBOX

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: BADBOX IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Folders

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Quarantine folder. This folder often contains archived samples, including known benign files that match BADBOX IOCs (such as specific hash values used in previous threat intelligence exercises). The scanner generates an alert when it detects these “known” hashes during its routine sweep.
  • Filter/Exclusion: Create a rule exclusion for processes running under the EDR service account (e.g., svc_falcon or LocalSystem) accessing paths containing \Quarantine\, \ThreatIntelligence\, or \SampleRepository\. Alternatively, tune the detection to ignore alerts where the “File Origin” is marked as “Internal Scan” rather than “User Execution.”

• IT Admin Deployment of Security Baselines via Group Policy

  • Scenario: A scheduled Group Policy Object (GPO) deployment pushes a security baseline update containing a set of configuration scripts and registry keys. These artifacts include specific file hashes or network signatures that overlap with the BADBOX IOC list (often used as reference benchmarks). When the GPO client (gpupdate.exe) applies these changes on domain-joined workstations, it triggers the detection logic.
  • Filter/Exclusion: Exclude alerts originating from the System user context where the parent process is svchost.exe with the service name gpsvc (Group Policy Client). Additionally, filter out events occurring during the defined maintenance window (e.g., Sundays 02:00–04:00 UTC) when bulk policy updates are