ThreatFox: Loki IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection identifies adversary activity by correlating network and host logs against three specific Indicators of Compromise (IOCs) linked to the Loki threat actor within Azure Sentinel. Proactive hunting for these IOCs is critical because Loki’s high-severity indicators often signal early-stage reconnaissance or lateral movement that may evade standard automated alerts, requiring manual investigation to prevent broader compromise.

IOC Summary

Malware Family: Loki Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`3d639a627186e77730ff2d1294df49a3`	payload	2026-08-25	95%
sha256_hash	`89f6c08fa045d14eb73a0992145a724bc34d531d7af3dcc4901a1b7c7833aede`	payload	2026-08-25	95%
sha1_hash	`dd971d09f94dbd77735a07fc297dd2836fd94616`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Loki
let malicious_hashes = dynamic(["3d639a627186e77730ff2d1294df49a3", "89f6c08fa045d14eb73a0992145a724bc34d531d7af3dcc4901a1b7c7833aede", "dd971d09f94dbd77735a07fc297dd2836fd94616"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Loki

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Loki IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download new definition packages from the vendor’s cloud. If the Loki threat feed includes IOCs matching the hash or domain of these update servers, the rule triggers during nightly maintenance windows.
- Filter/Exclusion: Create a whitelist exclusion based on the specific Process Name (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) and restrict the alert to non-business hours (e.g., 02:00–05:00 local time) for these processes.
Scenario: Automated Cloud Backup Jobs
- Context: Scheduled backup agents (such as Veeam, Rubrik, or Azure Backup) often initiate connections to external storage endpoints or management portals that may share IOCs with the Loki feed. These jobs run via Windows Task Scheduler or cron, generating network traffic that mimics command-and-control activity.
- Filter/Exclusion: Exclude alerts where the initiating process is a known backup service (e.g., Veeam.Backup.Service.exe) and the destination IP falls within the organization’s designated Cloud Storage CIDR range or specific backup vendor domains (e.g., *.rubrik.com, *.vcloud.azurewebsites.net).
Scenario: Software Deployment via Configuration Management Tools
- Context: IT operations teams using tools like Microsoft SCCM, Ansible, or Puppet push software updates and patches to endpoints. These tools often pull manifests or binaries from internal artifact