ThreatFox: MintsLoader IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the MintsLoader malware by searching for specific indicators of compromise (IOCs) that signal potential initial access or lateral movement within the environment. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections and prevent the execution of malicious payloads before they escalate into broader security incidents.

IOC Summary

Malware Family: MintsLoader Total IOCs: 9 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - MintsLoader
let malicious_domains = dynamic(["cloudcrypt7069.com", "cloudguard3537.lol", "coretoken8476.top", "datapass8636.top", "linkcast1961.com", "linkmail5768.com", "teleupdate6573.top", "nodemetrics3379.com", "apiupdate3921.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — MintsLoader

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding filters for the ThreatFox: MintsLoader IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Software Deployment via Endpoint Management Tools

  • Context: Enterprise endpoint management suites (e.g., Microsoft Intune, SCCM/MECM, or Ivanti) frequently push software updates or installers that match MintsLoader IOCs. For instance, a global rollout of a new PDF viewer or browser update might utilize an installer executable with a hash matching one of the 9 monitored IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM), IntuneManagementExtension.exe, or IvantiAgent.exe. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) on known deployment servers.

• Scenario: Scheduled Backup and Antivirus Scanning Jobs

  • Context: Automated backup solutions (such as Veeam Agent or Acronis Cyber Protect) often invoke scanning engines that generate file hashes identical to the MintsLoader IOCs during routine integrity checks. Similarly, local antivirus engines (like CrowdStrike Falcon or Symantec Endpoint Protection) may trigger on specific DLLs used by these backup agents.
  • Filter/Exclusion: Create an exclusion rule for processes spawned by VeeamAgent.exe, AcronisBackupService.exe, or the specific AV engine process (C:\Program Files\Microsoft Defender\MsMpEng.exe). Filter based on the command line containing keywords like “scan,” “backup,” or “integrity.”

• Scenario: Internal Development and CI/CD Pipeline Artifacts

  • Context: In organizations with internal DevOps teams, build agents (e.g., Jenkins, Azure Dev