ThreatFox: FAKEUPDATES IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors distribute fraudulent software updates to infiltrate systems and establish persistence through compromised supply chains. Proactively hunting these specific FAKEUPDATES indicators in Azure Sentinel is critical to rapidly identify early-stage compromise vectors before they escalate into widespread lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: FAKEUPDATES Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - FAKEUPDATES
let malicious_domains = dynamic(["fb-api.raydianpainting.com", "fb-api.raydianpainting.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — FAKEUPDATES

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: FAKEUPDATES IOCs detection rule, tailored for an enterprise environment:

• Authorized Software Deployment via SCCM/Intune

  • Scenario: The IT operations team deploys a legitimate update to the “FakeUpdates” vendor’s endpoint protection suite or a specific business application using Microsoft Endpoint Configuration Manager (MECM) or Intune. This triggers network connections to the vendor’s known update servers and downloads of executable installers that match the FAKEUPDATES IOCs, mimicking the behavior of the threat.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from specific SCCM Distribution Points (e.g., 10.20.30.45) or Intune Management Service IPs connecting to the known FAKEUPDATES update domains, provided the destination port is standard HTTPS (443) and the user context is a “System” or “Network Service” account rather than an interactive user session.

• Scheduled Patch Tuesday Maintenance Jobs

  • Scenario: A recurring scheduled task runs every second Tuesday at 02:00 AM to check for and apply security patches for third-party applications managed by the FAKEUPDATES vendor. The job executes a PowerShell script (CheckUpdates.ps1) that queries the vendor’s API, generating network flows and file creation events that align with the detection logic.
  • Filter/Exclusion: Exclude alerts where the process name matches powershell.exe or a specific scheduled task executable (e.g., UpdateChecker.exe) running under the “Local System” account during the defined maintenance window (01:30 AM – 04:30 AM), specifically when the parent process is TaskScheduler.

• Legitimate Admin Manual Updates

  • Scenario: A senior system administrator manually initiates