← Back to SOC feed Coverage →

ThreatFox: Kimwolf IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
apk-kimwolfiocthreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-03T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the execution of known Kimwolf indicators of compromise to detect potential supply chain or web-based infection vectors within the Azure environment. Proactively hunting for these specific IOCs is critical because it enables the SOC team to identify early-stage compromises before they escalate into broader lateral movements, leveraging Azure Sentinel’s real-time correlation capabilities to minimize dwell time.

IOC Summary

Malware Family: Kimwolf Total IOCs: 10 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port188[.]166[.]63[.]49:25001botnet_cc2026-07-03100%
ip:port167[.]71[.]1[.]193:25001botnet_cc2026-07-03100%
ip:port134[.]122[.]62[.]67:25001botnet_cc2026-07-03100%
ip:port164[.]92[.]146[.]175:25001botnet_cc2026-07-03100%
ip:port146[.]190[.]226[.]132:25001botnet_cc2026-07-03100%
ip:port68[.]183[.]8[.]190:25001botnet_cc2026-07-03100%
ip:port188[.]166[.]34[.]177:25001botnet_cc2026-07-03100%
ip:port64[.]227[.]70[.]229:25001botnet_cc2026-07-03100%
ip:port167[.]71[.]69[.]84:25001botnet_cc2026-07-03100%
ip:port161[.]35[.]155[.]56:25001botnet_cc2026-07-03100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Kimwolf
let malicious_ips = dynamic(["167.71.1.193", "64.227.70.229", "188.166.63.49", "164.92.146.175", "134.122.62.67", "188.166.34.177", "68.183.8.190", "167.71.69.84", "161.35.155.56", "146.190.226.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.71.1.193", "64.227.70.229", "188.166.63.49", "164.92.146.175", "134.122.62.67", "188.166.34.177", "68.183.8.190", "167.71.69.84", "161.35.155.56", "146.190.226.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Kimwolf IOCs detection rule, tailored for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/apk.kimwolf/