ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors leverage known KongTuke indicators of compromise to establish persistence and execute data exfiltration within Azure environments. Proactively hunting these specific IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate compromised assets before the threat can propagate laterally or escalate its impact across the cloud infrastructure.

IOC Summary

Malware Family: KongTuke Total IOCs: 8 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["azevedo.lol", "appcert9869.net", "tommy-z.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://azevedo.lol/file.js", "https://azevedo.lol/api/v1/session", "https://azevedo.lol/api/v1/verify", "https://appcert9869.net/update/package", "https://tommy-z.lol/o"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for an enterprise environment:

• Endpoint Security Policy Updates via CrowdStrike Falcon

  • Scenario: The Endpoint Detection and Response (EDR) agent pushes a new policy update containing a signature file or configuration script that matches one of the KongTuke hash values. This often occurs during the weekly Tuesday patch cycle when the FalconSensor service executes the UpdatePolicy task, triggering network traffic to external update servers that mimic the IOCs.
  • Suggested Filter: Exclude network connections originating from the EDR management console IP range (e.g., 10.50.20.0/24) and filter out processes named FalconService.exe or FalconSensor.exe when accessing known update endpoints.

• Automated Vulnerability Scanning by Tenable Nessus

  • Scenario: The scheduled nightly vulnerability scan job (NessusAgent) on critical web servers executes a plugin that downloads and validates a specific software component (e.g., an updated Java Runtime or OpenSSL library) which shares a hash with the KongTuke IOC. This generates legitimate file creation events and outbound DNS queries to vendor repositories that trigger the alert.
  • Suggested Filter: Create an exclusion for processes running under the System account on hosts tagged as “Scan-Target” during the defined maintenance window (02:00–04:00 UTC), specifically filtering out connections to *.tenable.com or *.oracle.com.

• Software Deployment via Microsoft SCCM/MECM

  • Scenario: The Configuration Manager (SCCM) deployment engine distributes a mandatory application package to the finance department. The installation script (ccmexec.exe) extracts a temporary installer that contains a KongTuke-associated DLL