ThreatFox: Elevator IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior involving the “Elevator” campaign by monitoring for specific indicators of compromise (IOCs) that signal active reconnaissance or initial access attempts within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect and respond to high-severity threats associated with this known threat actor, thereby minimizing potential dwell time before lateral movement occurs.

IOC Summary

Malware Family: Elevator Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`2899fcb03c3c0d5c6b504d2ab4f7b7dd`	payload	2026-08-25	95%
sha1_hash	`9c9792f75ee324657d381b6eceee5336e0c752a5`	payload	2026-08-25	95%
md5_hash	`2841cec724ba8a14f5f97527232596c0`	payload	2026-08-25	95%
sha256_hash	`d32b480e2cae0fe8597f58d360816487c7fbe63d524810624768ca700eaa8541`	payload	2026-08-25	95%
sha1_hash	`c10622a661cc81f44a4559514e70e14fe38ff4ac`	payload	2026-08-25	95%
sha256_hash	`a0c6e277bbb4848c967a3d4bf6aa45aab28ffa3249180e3026a89f80360d83f7`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Elevator
let malicious_hashes = dynamic(["2899fcb03c3c0d5c6b504d2ab4f7b7dd", "9c9792f75ee324657d381b6eceee5336e0c752a5", "2841cec724ba8a14f5f97527232596c0", "d32b480e2cae0fe8597f58d360816487c7fbe63d524810624768ca700eaa8541", "c10622a661cc81f44a4559514e70e14fe38ff4ac", "a0c6e277bbb4848c967a3d4bf6aa45aab28ffa3249180e3026a89f80360d83f7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Elevator

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Elevator IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Security Tool Updates via Windows Update or Intune
- Context: Enterprise endpoints running Microsoft Defender for Endpoint (MDE) or Intune often trigger background processes that download and install security definitions. These updates may generate network traffic matching the Elevator IOCs (specifically C2 domains or hash signatures) as part of their telemetry pipeline.
- Filter/Exclusion: Create a rule exclusion based on the ProcessName being UsbPnP.exe, MsMpEng.exe, or IntuneManagementExtension.exe. Additionally, filter out traffic originating from the internal IP range of the Software Update Point (SUP) server where these definitions are hosted.
Scenario: Scheduled Backup Jobs Utilizing Cloud Storage
- Context: Nightly backup agents such as Veeam Backup & Replication or Commvault often communicate with cloud storage providers (e.g., AWS S3, Azure Blob). If the Elevator IOC list includes generic cloud storage endpoints or specific hashing algorithms used by these vendors, legitimate backup traffic will trigger alerts.
- Filter/Exclusion: Exclude processes identified as VeeamTransportService.exe, vbrsvc.exe, or CommServe.exe. Implement a time-based filter to suppress alerts for this rule between 01:00 and 05:00 local time, coinciding with the standard backup window.
Scenario: Admin-Driven Software Deployment via SCCM/MECM
- Context: System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager frequently pushes application packages to workstations. During deployment, the ccmsetup.exe process may initiate connections to distribution points that share network signatures with