ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity by searching for seven specific Indicators of Compromise (IOCs) linked to the KongTuke threat actor within Azure Sentinel logs. Proactively hunting for these IOCs is critical because early identification allows the SOC team to rapidly isolate affected assets and mitigate potential data exfiltration or lateral movement before the threat escalates.

IOC Summary

Malware Family: KongTuke Total IOCs: 7 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["corralos.beer", "herndndes.beer"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://corralos.beer/api/v1/session", "https://corralos.beer/api/v1/verify", "https://corralos.beer/api/v1/status", "https://herndndes.beer/api/v1/verify", "https://herndndes.beer/api/v1/session"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Endpoint Protection Scans

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) frequently perform scheduled deep scans of the file system. If the KongTuke IOCs include specific hash values or file paths that match legitimate security definitions or cached scan logs, the rule may trigger during nightly maintenance windows.
  • Suggested Filter/Exclusion: Exclude alerts where the Process Name matches known EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) and the Parent Process is a scheduled task service (TaskHostW.exe). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Third-Party Patch Management Deployments

  • Context: During monthly patch cycles, tools like Ivanti Neurons or SCCM (System Center Configuration Manager) deploy updates that may include DLLs or executables matching the KongTuke IOCs. This often happens when a vendor update introduces a new component with a hash identical to one of the 7 tracked IOCs.
  • Suggested Filter/Exclusion: Create an exclusion for processes spawned by patch management services (e.g., ccmexec.exe, IvantiAgent.exe). Implement a logic check where if the File Creation Time is within 24 hours of a known patch deployment event, the alert is suppressed.

• Scenario: Internal DevOps CI/CD Pipeline Artifacts

  • Context: In environments using Jenkins or GitLab Runners for continuous integration, build artifacts and temporary container images