ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets the presence of specific KongTuke IOCs to identify potential compromise by this high-severity threat actor. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect early-stage intrusion attempts and mitigate risks before the adversary can establish persistence or exfiltrate data.

IOC Summary

Malware Family: KongTuke Total IOCs: 3 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["saaverra.sbs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://saaverra.sbs/api/v1/session", "https://saaverra.sbs/api/v1/verify"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

• Legacy Application Deployment via Group Policy Objects (GPOs)

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., a specific version of Adobe Reader or a proprietary ERP client) to a large user group via GPO. The installation package contains a binary or DLL that matches one of the KongTuke IOCs due to shared code signatures or similar hash values from older vendor builds.
  • Filter/Exclusion: Exclude alerts where the parent process is gpupdate.exe or svchost.exe (specifically the gpupdate service) and the file path resides under C:\Windows\SysWOW64\ or C:\Program Files\ for known legacy vendors.

• Scheduled Maintenance Jobs for Third-Party Monitoring Agents

  • Scenario: A scheduled task (e.g., Task Scheduler job named “DailyHealthCheck”) runs a third-party endpoint monitoring agent (such as a specific build of Carbon Black, CrowdStrike, or a custom internal agent) that performs a self-update or integrity check. The agent’s helper binary or temporary extraction file matches a KongTuke IOC because the vendor reused a common open-source library or build artifact.
  • Filter/Exclusion: Exclude alerts where the parent process is schtasks.exe or taskschd.msi and the working directory is within the vendor’s specific installation folder (e.g., C:\ProgramData\VendorName\ or C:\Program Files (x86)\VendorName\).

• CI/CD Pipeline Build Artifacts in Dev/Test Environments

  • Scenario: A CI/CD pipeline (e.g., Jenkins, Azure DevOps, or GitHub Actions) compiles a microservice in a development or staging environment. The build process creates temporary intermediate files or test binaries that match