ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by monitoring network traffic and endpoint logs against six specific Indicators of Compromise (IOCs) linked to the Kuiper threat actor. Proactively hunting for these signals in Azure Sentinel is critical because early identification of Kuiper’s unique behavioral patterns allows the SOC team to isolate compromised assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Kuiper Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`7d936e44f50cafb14afdc8ea652905f611db0f04f10da8feb5d5ba74bcbf5a22`	payload	2026-07-18	95%
sha1_hash	`4d66fca32efec8db198b4ff11ed5bb653a39d6e8`	payload	2026-07-18	95%
md5_hash	`52c1c5a26091c68f322fc44b0afcd6d0`	payload	2026-07-18	95%
md5_hash	`3dd256518361ce5770b58c28b2847df5`	payload	2026-07-18	95%
sha256_hash	`5cdb6a3810a5148518252110e51655297a6a9832f254f65f804b5a6fad1e3259`	payload	2026-07-18	95%
sha1_hash	`358cafc8ac2911426b31c56cce308437d68b0db7`	payload	2026-07-18	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["7d936e44f50cafb14afdc8ea652905f611db0f04f10da8feb5d5ba74bcbf5a22", "4d66fca32efec8db198b4ff11ed5bb653a39d6e8", "52c1c5a26091c68f322fc44b0afcd6d0", "3dd256518361ce5770b58c28b2847df5", "5cdb6a3810a5148518252110e51655297a6a9832f254f65f804b5a6fad1e3259", "358cafc8ac2911426b31c56cce308437d68b0db7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

Software Supply Chain Updates via Package Managers
- Scenario: Automated patch management tools (e.g., Ansible, Chef, or WSUS) pull dependencies from public repositories that host the Kuiper open-source project. During a scheduled nightly update, these tools download and verify the kuiper binary or Docker images, triggering network connections to the exact IPs and domains listed in the 6 IOCs.
- Filter/Exclusion: Create an exclusion rule for traffic originating from known Patch Management Server subnets (e.g., 10.20.50.0/24) or specific service accounts (e.g., svc-ansible-patch, wsus-admin). Additionally, filter out connections where the destination port is standard package registry ports (80, 443) and the User-Agent header contains “Ansible” or “WSUS”.
CI/CD Pipeline Artifact Retrieval
- Scenario: A DevOps team utilizes Jenkins or GitLab CI pipelines to build IoT edge applications. The pipeline includes a stage that fetches the latest Kuiper release artifacts from GitHub or Docker Hub for integration testing. This generates legitimate outbound traffic matching the IOC signatures during business hours when builds are triggered by developers.
- Filter/Exclusion: Exclude alerts where the source host is identified as a CI/CD Runner (e.g., hosts with tags env=prod-cicd or specific hostnames like jenkins-agent-01). Implement a filter to ignore traffic from these sources during standard build windows (e.g., 08:00–18:00 UTC) if the destination matches the Ku