ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets the presence of KongTuke IOCs, a high-severity threat often associated with targeted intrusions and advanced persistent threats. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting adversary operations before they achieve their objectives.

IOC Summary

Malware Family: KongTuke Total IOCs: 3 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["watsiia.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://watsiia.top/api/v1/session", "https://watsiia.top/api/v1/verify"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

• Scenario: A security operations team or threat intelligence platform (e.g., MISP, TheHive) automatically ingests the KongTuke IOC set into a SIEM or EDR solution for correlation testing, causing the IOCs (such as specific file hashes or network indicators) to appear in logs during the import process.

  • Filter/Exclusion: Exclude events where the source process is a known threat intelligence ingestion tool (e.g., misp-client, thehive-api) or where the user account is a dedicated service account for SIEM enrichment (e.g., svc-siem-enrichment).

• Scenario: A DevOps engineer is deploying a new microservice container image that was built from a base image containing a known library or binary that shares a hash with one of the KongTuke IOCs due to a common dependency or build artifact reuse.

  • Filter/Exclusion: Exclude detections where the file path resides within a container runtime directory (e.g., /var/lib/docker/overlay2/, /var/lib/containerd/) and the parent process is a container runtime daemon (e.g., dockerd, containerd-shim).

• Scenario: An IT administrator is performing a manual patching or software update cycle using a deployment tool like Ansible or SCCM, which temporarily downloads or stages a binary that matches an IOC hash before it is replaced by the updated version.

  • Filter/Exclusion: Exclude events where the parent process is a known deployment agent (e.g., ansible-playbook, ccmexec.exe, wsus service) and the event type is “File Created” or “File Modified” within a temporary staging directory (e.g., C:\Windows\Temp\, C:\ProgramData\CCM\).

• Scenario: A security analyst is conducting a red team exercise or