ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the KongTuke malware by identifying matches against six specific Indicators of Compromise (IOCs) within network and endpoint logs. Proactively hunting for these IOCs in Azure Sentinel is critical because it enables early identification of potential infections before they escalate into broader lateral movements or data exfiltration events.

IOC Summary

Malware Family: KongTuke Total IOCs: 6 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["reindardt.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://reindardt.lol/api/v1/status", "https://reindardt.lol/file.js", "https://reindardt.lol/api/v1/session", "https://reindardt.lol/api/v1/verify", "https://schuttc.lol/api/v1/status"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for an enterprise environment using common security and IT management tools.

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled daily policy refresh or definition update. During this process, the agent downloads and executes a script containing specific hash values or network signatures that overlap with KongTuke’s benign IOCs (often related to legitimate software supply chain components). This triggers an alert when the sensor communicates with the management console over standard ports.
  • Filter/Exclusion: Create an exclusion rule for the C:\Program Files\CrowdStrike\csagent.exe process path and whitelist the specific SHA256 hashes of the CrowdStrike update packages known to contain these IOCs. Additionally, exclude traffic originating from the internal CrowdStrike management subnet (e.g., 10.x.x.x/24) destined for the Falcon cloud endpoints.

• Automated Patch Deployment via Microsoft SCCM (Configuration Manager)

  • Scenario: A scheduled “Patch Tuesday” job runs on Windows 10/11 workstations using System Center Configuration Manager (SCCM). The deployment of a specific vendor update package involves downloading executable installers that match KongTuke’s file hash IOCs. This is often misidentified as suspicious activity because the installer executes in a temporary folder (%TEMP%) before moving to the Program Files directory, mimicking initial infection behavior.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (the SCCM client agent) or wuauserv.exe. Furthermore, add an exclusion for file paths starting with %TEMP%\CCMCache\ and whitelist the specific software update KB numbers associated with the vendor known to generate these IOCs.

• **Cloud