ThreatFox: Kuiper IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint logs against a curated set of 11 Indicators of Compromise (IOCs) specifically linked to the Kuiper threat campaign. Proactively hunting for these IOCs in Azure Sentinel is critical because it enables early identification of known malicious artifacts, allowing the SOC team to contain potential breaches before they escalate into widespread incidents.

IOC Summary

Malware Family: Kuiper Total IOCs: 11 IOC Types: sha1_hash, sha256_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["56160fa06b16e3822879e77aa47f0764", "dc33f06c86f021af72cc89e1feafa16dad624d43a79242ab738518480a0aef88", "6e6db8bfff48fb23ca12b33a4c0272d787633e06", "9d54fa92c215c6ae6eb7b238ba640c10d9ae2c2c", "b3fabcc24d9c8b12a02126d2102a48f9", "8daa6c064b47a03c85bc0eff732da07e0e8966cfc69771e3b9597cad9a155b13", "d9e1f05c2fef02d320bc2b6aa901f4fd", "ed6a55a28e22520219c90adeb569c114ab8f01f1e1f2674e06615fe046e7a291", "f24465bbae171b3b2dadc5403cac20e6a22bb7b3", "de1efd1c7a44c5fd268cba68dd9ad9fbc4587536", "762792354f7114f7de7420b0c2d77912"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Kuiper

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Kuiper IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: The enterprise’s endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs nightly definition updates. These packages often reference hash values or URLs that overlap with the 11 Kuiper IOCs, particularly if the vendor uses a shared CDN or repository structure similar to the threat intelligence feed.
  • Filter/Exclusion: Create an exclusion rule based on Process Name and User Context. Exclude alerts generated by MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) when executed under the system account (NT AUTHORITY\SYSTEM) during the maintenance window (e.g., 02:00 – 04:00 UTC).

• Scenario: Automated Cloud Backup and Sync Jobs

  • Context: Enterprise file synchronization tools like Microsoft OneDrive for Business or Dropbox Business run background sync jobs. These agents frequently connect to external storage endpoints that may share IP ranges or domain suffixes with the Kuiper IOCs, triggering a match on network connection logs.
  • Filter/Exclusion: Implement a filter excluding traffic originating from specific Service Accounts (e.g., svc-onedrive-sync) and limiting the scope to known internal subnets (e.g., 10.20.x.x). Additionally, exclude connections where the destination port is strictly 443 (HTTPS) and the process path contains \Microsoft OneDrive\.

• Scenario: Patch Management Deployment via SCCM

  • Context: During monthly patch cycles, System Center Configuration Manager (SCCM) or Intune pushes updates to endpoints. The deployment agents often download payloads from Microsoft Update servers or third