ThreatFox: Triada IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior consistent with the Triada malware campaign by identifying network traffic and host artifacts matching its specific set of 89 Indicators of Compromise (IOCs). Proactively hunting for these indicators in Azure Sentinel is critical to rapidly identify early-stage infections and mitigate potential lateral movement before the threat escalates into a full-blown incident.

IOC Summary

Malware Family: Triada Total IOCs: 89 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`84bddb4249fecd2ab39b957c6394c828d8cf52b30c93012d91d229300fe5b272`	payload	2026-07-13	75%
sha256_hash	`dc25c20249bb00a996d25421f51518d4d731779a2b0351d80eb69cc7643f5dc9`	payload	2026-07-13	75%
sha256_hash	`b12890de51d3879bfbef2605fa74cb577a331a9fe6542b5551a57878175242b7`	payload	2026-07-13	75%
sha256_hash	`b71a5204be101bf70949cf9139734b2c24f221c90f13a937ff42579e8c16abab`	payload	2026-07-13	75%
sha256_hash	`b732b3584d7ca6f0efa23e4f769d097f78a834f8ab27c82fbdb72bb9bbb889f9`	payload	2026-07-13	75%
sha256_hash	`c2e14ab636b91d09035f9f3cd539fb440803420e43d5ccd863a26cf76e62bb3a`	payload	2026-07-13	75%
sha256_hash	`c426daade9bacef035bbb1313f7e671ca5fae400d756670a869465f90acdd0c6`	payload	2026-07-13	75%
sha256_hash	`d1faaba9ccaa1ab752619342809a71d33562c69292debeafdbefcd72e0482034`	payload	2026-07-13	75%
sha256_hash	`db49945ae3e345c98501a4a9ba114f8d0ee17c8e6d12accdd5b8fb11f37290fa`	payload	2026-07-13	75%
sha256_hash	`e33572e56b5e3c0f75e2b7f21a3bb4a26e8616bfcbbcaaf727154a24842e823b`	payload	2026-07-13	75%
sha256_hash	`eb75d27b128dc1d52e7995a404e679972fe9c881551052acbc73830a88fc98f5`	payload	2026-07-13	75%
sha256_hash	`eba6b5445b17bb12c5906151ac462af92e183ab4e4166d2c7517a35e2dc0fc79`	payload	2026-07-13	75%
sha256_hash	`ecb9ef2e567994ea1875226028331499d3ecf38e4426dc9ec76c26f855721c00`	payload	2026-07-13	75%
sha256_hash	`ef3058513d8602821716b37128f30174022695e032dd459a6c892d268a46abfb`	payload	2026-07-13	75%
sha256_hash	`f32ae21132020fd3af9479f846d4c2cbcf37c245214d298d7e70d6a14d00591e`	payload	2026-07-13	75%
sha256_hash	`fbf1f069f8b9054ff20372363d41140bc12a39115245d73fac66eabc7131ac81`	payload	2026-07-13	75%
sha256_hash	`fe4195f80a950008daed587cb52b788616a54c9f09c73f42199c3f72b00fb365`	payload	2026-07-13	75%
sha256_hash	`12de27788ff089d827775fb562f89c1793122de3c7acc7bc0625c8a6496b1238`	payload	2026-07-13	75%
sha256_hash	`14438a46fae8d846e700db6d0233f2eb38ccb15ba31ec445532e2fb755edd0b6`	payload	2026-07-13	75%
sha256_hash	`1c9feb726b51601660408b3ad008d6fccdd8244158ae4179801df14f3df41e37`	payload	2026-07-13	75%
sha256_hash	`13467dfc0be4aa390a3b7b4873835c3cbcaad56e14e47545d4b205fedd86e662`	payload	2026-07-13	75%
sha256_hash	`13ba45489313dcd40736bb2a0b17c8a22197836485617a39515f400137c5c3b8`	payload	2026-07-13	75%
sha256_hash	`1b32baeb3ab66c02778e6a1de6b5840e57519cedf49f6448c9158b9c4cd34a0c`	payload	2026-07-13	75%
sha256_hash	`18bc19036d0195cd49f3de77c41df13982b0d2e9caddbdd8839039bd4a028cac`	payload	2026-07-13	75%
sha256_hash	`18a1b42350607e3b8fca55f9bb0def6e8ddb8816688bcad71c5dab0571849455`	payload	2026-07-13	75%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Triada
let malicious_hashes = dynamic(["84bddb4249fecd2ab39b957c6394c828d8cf52b30c93012d91d229300fe5b272", "dc25c20249bb00a996d25421f51518d4d731779a2b0351d80eb69cc7643f5dc9", "b12890de51d3879bfbef2605fa74cb577a331a9fe6542b5551a57878175242b7", "b71a5204be101bf70949cf9139734b2c24f221c90f13a937ff42579e8c16abab", "b732b3584d7ca6f0efa23e4f769d097f78a834f8ab27c82fbdb72bb9bbb889f9", "c2e14ab636b91d09035f9f3cd539fb440803420e43d5ccd863a26cf76e62bb3a", "c426daade9bacef035bbb1313f7e671ca5fae400d756670a869465f90acdd0c6", "d1faaba9ccaa1ab752619342809a71d33562c69292debeafdbefcd72e0482034", "db49945ae3e345c98501a4a9ba114f8d0ee17c8e6d12accdd5b8fb11f37290fa", "e33572e56b5e3c0f75e2b7f21a3bb4a26e8616bfcbbcaaf727154a24842e823b", "eb75d27b128dc1d52e7995a404e679972fe9c881551052acbc73830a88fc98f5", "eba6b5445b17bb12c5906151ac462af92e183ab4e4166d2c7517a35e2dc0fc79", "ecb9ef2e567994ea1875226028331499d3ecf38e4426dc9ec76c26f855721c00", "ef3058513d8602821716b37128f30174022695e032dd459a6c892d268a46abfb", "f32ae21132020fd3af9479f846d4c2cbcf37c245214d298d7e70d6a14d00591e", "fbf1f069f8b9054ff20372363d41140bc12a39115245d73fac66eabc7131ac81", "fe4195f80a950008daed587cb52b788616a54c9f09c73f42199c3f72b00fb365", "12de27788ff089d827775fb562f89c1793122de3c7acc7bc0625c8a6496b1238", "14438a46fae8d846e700db6d0233f2eb38ccb15ba31ec445532e2fb755edd0b6", "1c9feb726b51601660408b3ad008d6fccdd8244158ae4179801df14f3df41e37", "13467dfc0be4aa390a3b7b4873835c3cbcaad56e14e47545d4b205fedd86e662", "13ba45489313dcd40736bb2a0b17c8a22197836485617a39515f400137c5c3b8", "1b32baeb3ab66c02778e6a1de6b5840e57519cedf49f6448c9158b9c4cd34a0c", "18bc19036d0195cd49f3de77c41df13982b0d2e9caddbdd8839039bd4a028cac", "18a1b42350607e3b8fca55f9bb0def6e8ddb8816688bcad71c5dab0571849455", "174fb1202023795b7b800a7a1df621f2265f29898d8084ec7d7c155fae66cc0a", "16ce238bae097e8c1c85e9c6f8b94eaf3a31431a84d82c25afaae874d4128d1a", "16919b7c70d1ac6bd35add83c94cef0ac5f7793372b7e8d70e2cd18d2e846f86", "1631d66da46472a743b221900bef6d07371d80ac170ec4d1a1e02af5e8f3fdba", "15e88b6e8590b5405c94dd395b1f33ced96a82073bbb8c3bac311cba9d79b72d", "0db4b9b06c2e05a60017bc0198d1627f55de41565c8ae30c823a99ef504a546b", "103583686cde76ef43b92fb9b7864f7242a0031afbc2f54fbbbefbc451251aad", "1389b1493f4112938ae22e6a3ae595bc7a2bca19cd308f1b8b84899c5b8dcf37", "677c3054ca1a07cf6cdd0398f615f60ab69449d3b00dd9626e5caf71cda17829", "9ce859a03c883759048cb702b5b187ac57ec14ab8fd12d1be5d70c39c0aa3deb", "9e337f5c3dccbb55c0e087ab3ff624c40789206135b4aa66d8266b888f1a4136", "6333a7c2c56d9cc23ecc360870d3f784bd8557b60fedf94c7241468085d383f4", "3098914bbad0149feda5f9ce9c14e1d4c0db37ed103e25384a6c9fbd5464733b", "18e2006ae25b12849a17cc8d94f009cfc43c5fb3a4d6b0b734732aa0f46066e9", "72d0dbd8103521598061f22449ffa78107ccc60f1460fdf138de20d9623957ea", "9b63f82a69ca19519cb188de471334479bf638af1d6cbc81aa58aab2d11f39ae", "10f0b9fe9fb08fe804622dccfc33517e3db86b72453bdec6ab2482b5c06b7791", "c219760a9a685e94da130a56703f9be06adff8021dea5837b710dc7c1fd0dfae", "b87a1bf2c48aadf3515b66a951b1e6fa6bd0e563f3529707f6201784cdfb8a3c", "3d34c01ca87b8dab5bbdb9ef542efa50e6d44b5a39c4fe632a23c997af474c05", "b481de1e109a8395487aefe78174662b4fb8a02e8a3d520c5a1288f5dd2b6ec8", "7dfc057b129dc9156417334e8124e71343bc1aaeb60fffc370af58753748ebe0", "3f4bcaa0231d67040cf58eac16679c847795808e364139d4e944bc7338d41877", "9974f44a315d71e74ce110d9dfcc7b58fcd8169718ffe13d0cb1975f071a45aa", "cb0e709592ddb0e75862ab856af8cc887bdf47a2ee69495a8c062ae225e4a773"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Triada

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Triada IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s EDR solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled deep scan of the “Quarantine” folder on file servers. This folder contains historical archives of known benign files that happen to match Triada IOCs (specifically SHA256 hashes of older legitimate software installers previously flagged as suspicious).
- Suggested Filter: Exclude alerts where the Process Path is located within the EDR’s quarantine directory (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine) and the Event Type indicates a “Scan” or “Verification” action rather than an active execution.
Software Deployment via Configuration Management Tools
- Scenario: During a monthly patching cycle, the IT team uses Ansible or Microsoft SCCM (Configuration Manager) to deploy a new version of a third-party utility (e.g., Adobe Acrobat Reader or Zoom) that contains a library file matching one of the Triada IOCs. The deployment agent extracts and executes this file on thousands of workstations simultaneously, triggering the rule across the board.
- Suggested Filter: Create an exclusion for processes spawned by known deployment agents (e.g., ccmexec.exe, ansible-runner.py) where the Parent Process Name matches these tools and the execution occurs during standard maintenance windows (e.g., 02:00 – 06:00 local time).
Security Information and Event Management (SIEM) Log Ingestion
- Scenario: The SIEM platform (e.g., Splunk or Azure