ThreatFox: BeaverTail IOCs

Hunt Hypothesis

This hunt identifies potential compromise by BeaverTail, a threat actor known for deploying web shells and leveraging stolen credentials, through the presence of specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage intrusion attempts and isolate affected assets before the adversary can establish persistence or escalate privileges.

IOC Summary

Malware Family: BeaverTail Total IOCs: 4 IOC Types: ip:port, domain, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - BeaverTail
let malicious_ips = dynamic(["151.80.76.67"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["151.80.76.67"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - BeaverTail
let malicious_domains = dynamic(["a5lab.co"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - BeaverTail
let malicious_urls = dynamic(["http://151.80.76.67:1224/api/checkStatus", "https://a5lab.co/api/settings/linux"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — BeaverTail

False Positive Guidance

• Legacy Application Maintenance Scripts: A legacy Java-based enterprise application (e.g., SAP NetWeaver or Oracle EBS) uses a custom shell script to rotate logs or clean up temporary files, which inadvertently matches a BeaverTail IOCs such as a specific process name (e.g., java.exe with a specific command-line argument pattern) or a known hash for a bundled JAR file.

  • Filter/Exclusion: Exclude events where the parent process is cmd.exe or powershell.exe initiated by a service account (e.g., svc_app_maint) and the working directory is within the application’s installation path (e.g., C:\Program Files\SAP\).

• Third-Party Backup Agent Updates: A backup solution like Veeam or Commvault pushes an update to its agent binaries on file servers. The new agent binary has a SHA-256 hash that matches one of the BeaverTail IOCs (often due to shared code libraries or similar build processes), triggering a hash-based IOC match.

  • Filter/Exclusion: Exclude hash matches where the file path contains Veeam, Commvault, or Backup and the parent process is the backup service executable (e.g., vbrsvc.exe or cvbackup.exe).

• Scheduled Log Rotation via Cron/CronTab: On Linux-based application servers, a cron job runs a script that copies or moves log files to an archive directory. If the script uses a standard tool like cp or mv with specific arguments that match a BeaverTail behavioral IOC (e.g., copying a file to a specific temporary path), it may trigger the rule.

  • Filter/Exclusion: Exclude events on Linux hosts where the parent process is cron or crond and the user is a system service account (e.g., app_user