ThreatFox: Tsunami IOCs

Hunt Hypothesis

This hunt targets the presence of known Tsunami IOCs to identify potential compromise by this threat actor, which often leverages these indicators for initial access or persistence. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to detect and isolate affected assets before the adversary can establish a foothold or execute further malicious activities within the environment.

IOC Summary

Malware Family: Tsunami Total IOCs: 2 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Tsunami
let malicious_hashes = dynamic(["86947b00a3d61b82b6f752876404953ff3c39952f2b261988baf63fbbbd6d6ae", "0d762c8cbba56cd827c0dc710688d7410840940b9994020b8e365b63d3ff316c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsunami

False Positive Guidance

• Scenario: A DevOps engineer manually deploys a containerized microservice using a Docker image tagged with a known Tsunami-associated hash or registry path (e.g., docker pull registry.example.com/tsunami-gateway:1.2.3) as part of a standard CI/CD pipeline.
  • Filter/Exclusion: Exclude events where the source process is docker.exe or containerd-shim and the command line contains pull or run, provided the container name matches the approved tsunami-gateway service in the CMDB.
• Scenario: An IT administrator runs a scheduled PowerShell script to patch or update a legacy application component that shares a binary name or path with a Tsunami IOC (e.g., C:\Program Files\LegacyApp\tsunami_update.exe), triggered by a Windows Task Scheduler job named “Weekly App Maintenance.”
  • Filter/Exclusion: Exclude execution events where the parent process is Task Scheduler (svchost.exe or taskschd.msi) and the file path matches the known legacy application directory C:\Program Files\LegacyApp\, verifying the digital signature matches the internal vendor.
• Scenario: A security team performs a routine vulnerability scan using Nessus or Qualys, which temporarily creates a staging folder or drops a probe file matching a Tsunami IOC filename (e.g., tsunami_probe.tmp) in a shared network drive or user temp directory to test file creation permissions.
  • Filter/Exclusion: Exclude file creation events where the source process is a known scanning tool (e.g., nessus.exe, qualys_agent.exe) and the destination path is within a designated scan staging directory (e.g., C:\Temp\ScanStaging\ or \\fileserver\scans\).
• Scenario: A developer clones a Git