ThreatFox: Kuiper IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the Kuiper malware family to detect early-stage activities involving credential theft, persistent access establishment, and sensitive data exfiltration. Proactively hunting for these indicators in Azure Sentinel is critical due to the high severity of Kuiper’s ability to execute arbitrary code, which can rapidly compromise cloud workloads if not identified before lateral movement occurs.

IOC Summary

Malware Family: Kuiper Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`2fc0d48f26330997001a2cd70ee5ec504b7985178cee9a9ed16730502db7e42f`	payload	2026-08-14	95%
sha1_hash	`ea79f600b22ef30ffac57a4dccecb08142b5380c`	payload	2026-08-14	95%
md5_hash	`3b5870ca6edb52e878ddadcaa9ade7f8`	payload	2026-08-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["2fc0d48f26330997001a2cd70ee5ec504b7985178cee9a9ed16730502db7e42f", "ea79f600b22ef30ffac57a4dccecb08142b5380c", "3b5870ca6edb52e878ddadcaa9ade7f8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Kuiper

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, including tailored filters and exclusions:

Scenario: Legitimate deployment of third-party backup agents (e.g., Veeam or Commvault) on domain controllers. These agents often utilize service accounts with high privileges to perform scheduled data exfiltration and code execution tasks that mimic Kuiper’s persistence mechanisms.
- Filter/Exclusion: Exclude processes matching the executable path C:\Program Files\Veeam\Backup and Replication Service\vbagent.exe or C:\Program Files\Commvault\Agent\bin\cvd.exe when the user context is a dedicated service account (e.g., DOMAIN\svc_backup) rather than an interactive user.
Scenario: Automated patching workflows executed by Microsoft Endpoint Configuration Manager (SCCM) or Intune. These tools frequently push arbitrary code updates and modify registry keys for persistence during maintenance windows, which can trigger the “arbitrary code execution” logic of the rule.
- Filter/Exclusion: Create a filter to ignore alerts where the parent process is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically occurring between 02:00 and 06:00 local time on weekdays.
Scenario: Scheduled PowerShell scripts running as part of IT Operations management tasks, such as log rotation or user provisioning. These scripts often invoke external tools via Start-Process to handle data movement, resembling the credential usage and exfiltration behavior of Kuiper.
- Filter/Exclusion: Exclude alerts where the command line arguments contain specific known script hashes (e.g., SHA256 hash of C:\Scripts\Ops\UserProvisioning.ps1) or where the process name is powershell.exe running under a scheduled task context