ThreatFox: Tsunami IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of known Tsunami threat indicators, which often signal active reconnaissance or initial access attempts by a sophisticated adversary. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets or lateral movement paths before the threat actor can establish persistence or escalate privileges within the environment.

IOC Summary

Malware Family: Tsunami Total IOCs: 3 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572`	payload	2026-09-12	100%
sha256_hash	`a2d67291d87fe8f4d6e92fdb45c0190fb372cdd2c83ccc9ab8fb81bf69c74588`	payload	2026-09-12	100%
sha256_hash	`7d22fabcc98916294775e10101526492c105b583ccc9cf3e2edad9187dab4f14`	payload	2026-09-12	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Tsunami
let malicious_hashes = dynamic(["9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572", "a2d67291d87fe8f4d6e92fdb45c0190fb372cdd2c83ccc9ab8fb81bf69c74588", "7d22fabcc98916294775e10101526492c105b583ccc9cf3e2edad9187dab4f14"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Tsunami

False Positive Guidance

Scenario: A DevOps team deploys a new microservice using a container image that includes a legacy monitoring agent or a specific version of a third-party library (e.g., libcurl or a specific openssl build) which matches one of the Tsunami IOCs (such as a known SHA256 hash or file path) due to shared dependencies.
- Filter/Exclusion: Exclude files located within standard container runtime paths (e.g., /var/lib/docker/overlay2/, /var/lib/kubelet/pods/) or specific application directories (e.g., /opt/app/services/) if the IOC is a file hash or path-based.
Scenario: An IT administrator manually downloads a known-good backup tool or a specific version of a network scanner (e.g., nmap or masscan) from a trusted internal repository to perform a quarterly vulnerability assessment, and the binary’s hash or path matches a Tsunami IOC that was originally derived from a compromised build of the same tool.
- Filter/Exclusion: Exclude processes or files originating from trusted internal artifact repositories (e.g., \\corp-srv\tools\, artifacts.internal.corp) or exclude specific user groups (e.g., IT-Admins, SecOps-Team) when the IOC is a process name or binary hash.
Scenario: A scheduled maintenance job (e.g., cron task or Windows Task Scheduler) runs a script that copies a configuration file or a small utility binary to a temporary directory (/tmp/ or %TEMP%) for processing, and the file’s metadata or path matches an IOC associated with Tsunami’s staging behavior.
- Filter/Exclusion: Exclude files in temporary directories (/tmp/, /var/tmp/, %TEMP%, %TMP%) if the parent process is a