ThreatFox: FAKEUPDATES IOCs

Hunt Hypothesis

Adversaries deploy FAKEUPDATES malware via phishing or fake update portals to exfiltrate sensitive data and establish C2 channels through compromised domains. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify unauthorized outbound connections and anomalous process executions before the malware can fully compromise the environment.

IOC Summary

Malware Family: FAKEUPDATES Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - FAKEUPDATES
let malicious_domains = dynamic(["ship-js.veecargoexpresscouriers.com", "mesh.officialx-token.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — FAKEUPDATES

False Positive Guidance

• Legitimate Software Update Verification: When IT administrators or automated patch management tools (e.g., SCCM, Ansible, or custom PowerShell scripts) perform integrity checks or version verification against known vendor update servers, they may initiate outbound HTTPS connections to domains that share similar naming conventions or IP ranges with FAKEUPDATES C2 infrastructure.

  • Filter/Exclusion: Exclude outbound traffic from specific administrative service accounts (e.g., svc-patch, admin-ops) or known patch management server IPs (e.g., 10.20.5.10) when the destination domain matches the FAKEUPDATES IOC list but the source is a trusted internal management subnet.

• Scheduled Backup or Sync Jobs: Enterprise backup solutions (e.g., Veeam, Commvault) or cloud sync agents (e.g., OneDrive for Business, SharePoint connectors) often run scheduled tasks that establish persistent outbound connections to cloud endpoints or staging servers. If these endpoints are temporarily hosted on infrastructure that overlaps with FAKEUPDATES IOCs (due to shared hosting providers or CDN edge nodes), the rule may trigger.

  • Filter/Exclusion: Exclude connections originating from processes associated with backup or sync services (e.g., vssadmin.exe, OneDrive.exe, SharePointSync.exe) if the connection occurs during defined maintenance windows (e.g., 02:00–04:00 UTC) and the destination port is 443.

• DevOps CI/CD Pipeline Artifacts: In development environments, CI/CD pipelines (e.g., Jenkins, Azure DevOps, GitHub Actions) frequently pull dependencies or push artifacts to private registries or staging servers. If these internal registries or staging environments use domains that are subdomains of or closely related to FAKEUPDATES C2 domains (e.g., updates.internal.corp vs. `updates