ThreatFox: RedTail IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary activity linked to the RedTail threat actor by correlating network and endpoint telemetry against a curated set of 29 specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because RedTail’s sophisticated tradecraft often evades standard signature-based defenses, requiring manual validation to confirm early-stage lateral movement or data exfiltration attempts.

IOC Summary

Malware Family: RedTail Total IOCs: 29 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`112[.]52[.]34[.]18:2375`	payload_delivery	2026-06-29	80%
ip:port	`134[.]209[.]202[.]49:2375`	payload_delivery	2026-06-29	80%
ip:port	`167[.]94[.]146[.]49:2375`	payload_delivery	2026-06-29	80%
ip:port	`172[.]236[.]228[.]227:2375`	payload_delivery	2026-06-29	80%
ip:port	`173[.]255[.]225[.]25:2375`	payload_delivery	2026-06-29	80%
ip:port	`193[.]32[.]162[.]60:2375`	payload_delivery	2026-06-29	80%
ip:port	`199[.]45[.]155[.]108:2375`	payload_delivery	2026-06-29	80%
ip:port	`2[.]57[.]122[.]202:2375`	payload_delivery	2026-06-29	80%
ip:port	`20[.]150[.]193[.]32:2375`	payload_delivery	2026-06-29	80%
ip:port	`20[.]65[.]195[.]35:2375`	payload_delivery	2026-06-29	80%
ip:port	`209[.]50[.]170[.]112:2375`	payload_delivery	2026-06-29	80%
ip:port	`45[.]79[.]5[.]11:2375`	payload_delivery	2026-06-29	80%
ip:port	`47[.]84[.]194[.]39:2375`	payload_delivery	2026-06-29	80%
ip:port	`65[.]49[.]20[.]67:2375`	payload_delivery	2026-06-29	80%
ip:port	`104[.]207[.]47[.]232:2375`	payload_delivery	2026-06-29	80%
ip:port	`104[.]207[.]59[.]109:2375`	payload_delivery	2026-06-29	80%
ip:port	`109[.]91[.]201[.]209:2375`	payload_delivery	2026-06-29	80%
ip:port	`159[.]195[.]76[.]136:2375`	payload_delivery	2026-06-29	80%
ip:port	`157[.]245[.]123[.]148:2375`	payload_delivery	2026-06-29	80%
ip:port	`162[.]227[.]109[.]103:2375`	payload_delivery	2026-06-29	80%
ip:port	`169[.]150[.]201[.]135:2375`	payload_delivery	2026-06-29	80%
ip:port	`172[.]185[.]40[.]47:2375`	payload_delivery	2026-06-29	80%
ip:port	`172[.]202[.]118[.]46:2375`	payload_delivery	2026-06-29	80%
ip:port	`173[.]177[.]131[.]92:2375`	payload_delivery	2026-06-29	80%
ip:port	`174[.]170[.]194[.]116:2375`	payload_delivery	2026-06-29	80%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RedTail
let malicious_ips = dynamic(["20.150.193.32", "65.49.20.67", "20.65.195.35", "173.255.225.25", "47.84.194.39", "157.245.123.148", "167.94.146.49", "104.207.59.109", "176.146.33.242", "169.150.201.135", "172.185.40.47", "159.195.76.136", "199.45.155.108", "172.236.228.227", "174.18.49.143", "2.57.122.202", "193.32.162.60", "174.170.194.116", "178.26.11.44", "134.209.202.49", "176.144.233.36", "162.227.109.103", "45.79.5.11", "172.202.118.46", "209.50.170.112", "112.52.34.18", "173.177.131.92", "104.207.47.232", "109.91.201.209"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["20.150.193.32", "65.49.20.67", "20.65.195.35", "173.255.225.25", "47.84.194.39", "157.245.123.148", "167.94.146.49", "104.207.59.109", "176.146.33.242", "169.150.201.135", "172.185.40.47", "159.195.76.136", "199.45.155.108", "172.236.228.227", "174.18.49.143", "2.57.122.202", "193.32.162.60", "174.170.194.116", "178.26.11.44", "134.209.202.49", "176.144.233.36", "162.227.109.103", "45.79.5.11", "172.202.118.46", "209.50.170.112", "112.52.34.18", "173.177.131.92", "104.207.47.232", "109.91.201.209"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — RedTail

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: RedTail IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

Endpoint Security Agent Updates via Internal Repository
- Scenario: The organization’s internal patching server (e.g., WSUS, SCCM/MECM, or Ivanti) pushes a security definition update containing the RedTail hash to thousands of endpoints. This triggers alerts on every workstation as the agent downloads and installs the file, which matches one of the 29 IOCs but is a known legitimate artifact.
- Filter/Exclusion: Create an exclusion for source IPs belonging to the internal patching infrastructure subnet (e.g., 10.x.y.z range) or filter by process name ccmexec.exe, wsusutil.exe, or ivantiagent.exe. Additionally, exclude events where the file path is located in standard update directories like C:\Windows\SoftwareDistribution\Download\Install.
Scheduled Enterprise Backup Jobs
- Scenario: A nightly backup job using Veeam Backup & Replication or Commvault scans a shared network drive that contains archived threat intelligence feeds. The RedTail IOC file (likely a CSV or JSON report) is part of this archive and gets read/processed by the backup engine, triggering the detection logic on the backup server itself.
- Filter/Exclusion: Exclude alerts generated by specific service accounts used for backups (e.g., svc_veeam, cv_agent) and restrict the rule to trigger only if the process is not a known backup executable (vbr.exe, simagent.exe). You may also add a time-based filter to suppress these alerts during the defined maintenance window (e.g., 02:00 – 04:00 UTC).
**IT