ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior where malicious actors leverage specific Indicators of Compromise (IOCs) from the Kuiper threat intelligence feed to establish initial footholds or command-and-control channels within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because it enables the SOC team to identify and isolate potential compromises early, capitalizing on high-fidelity external intelligence before broader lateral movement occurs.

IOC Summary

Malware Family: Kuiper Total IOCs: 10 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`879ad6297b69d8265245cc370e7c0d05`	payload	2026-07-13	95%
md5_hash	`0c193f0e39efbab65b8ab5dbd6bdb7e2`	payload	2026-07-13	95%
sha256_hash	`9587e8422655a68369d7b00e521b7d1cd3b32e57b624c253526a9b0e094f33fc`	payload	2026-07-13	95%
sha1_hash	`c07235fe29987131be0d3640164d9c720094c7c0`	payload	2026-07-13	95%
sha256_hash	`25f0b776a5fa4bbf0f0727207cdcf58b3f883d2f0e210556350d050b427e69d4`	payload	2026-07-13	95%
sha1_hash	`cff5e73dac39d69216ae96b95134373ff5ffc418`	payload	2026-07-13	95%
md5_hash	`866428edb5f4c4900085fc9cd5f114f0`	payload	2026-07-13	95%
sha256_hash	`655456dd88dbb7f8c7770dc5abd8637a4a5177c8df3edea15f51f49eee1cf325`	payload	2026-07-13	95%
sha1_hash	`cb822a77c0b8eac0f1a38aa488db71939c44dd39`	payload	2026-07-13	95%
md5_hash	`0a6d724265d49486a917d7af4907cda2`	payload	2026-07-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["879ad6297b69d8265245cc370e7c0d05", "0c193f0e39efbab65b8ab5dbd6bdb7e2", "9587e8422655a68369d7b00e521b7d1cd3b32e57b624c253526a9b0e094f33fc", "c07235fe29987131be0d3640164d9c720094c7c0", "25f0b776a5fa4bbf0f0727207cdcf58b3f883d2f0e210556350d050b427e69d4", "cff5e73dac39d69216ae96b95134373ff5ffc418", "866428edb5f4c4900085fc9cd5f114f0", "655456dd88dbb7f8c7770dc5abd8637a4a5177c8df3edea15f51f49eee1cf325", "cb822a77c0b8eac0f1a38aa488db71939c44dd39", "0a6d724265d49486a917d7af4907cda2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Scenario: Internal Threat Intelligence Feed Synchronization
- Context: The Security Operations Center (SOC) utilizes a commercial threat intelligence platform (e.g., Recorded Future, Anomali, or CrowdStrike Falcon Intelligence) that ingests the Kuiper feed. During scheduled synchronization windows, the internal SIEM or EDR agent queries these IOCs to update local databases, generating network traffic and file access events matching the rule’s 10 specific indicators.
- Filter/Exclusion: Exclude alerts where the source IP belongs to the Threat Intelligence Management Server subnet (e.g., 10.20.50.x) or where the process name is the specific sync daemon (e.g., threat_sync_service.exe or anomalid).
Scenario: Endpoint Protection Policy Updates via GPO
- Context: The IT Administration team deploys a Group Policy Object (GPO) to update antivirus definitions and firewall rules across the domain. This deployment involves downloading signature packages from an internal distribution point that hosts the Kuiper IOC list, triggering file creation and network connection events on thousands of workstations simultaneously during business hours.
- Filter/Exclusion: Create a rule exclusion for events originating from the System account (NT AUTHORITY\SYSTEM) running under the process gpupdate.exe or msiexec.exe, specifically when the destination IP matches the internal Software Update Distribution Server.
Scenario: Scheduled Vulnerability Scanning (Tenable/Nessus)
- Context: A nightly vulnerability scan is executed using Tenable Nessus or Qualys. The scanner actively probes endpoints and network devices against a custom