ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the SmartApeSG campaign by identifying network connections or file artifacts matching three specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical because early detection of this high-severity threat enables rapid containment before the adversary can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["moonlitprovince.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://moonlitprovince.top/router/verify-build", "https://moonlitprovince.top/router/handler-asset.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, tailored for a legitimate enterprise environment:

• Endpoint Protection Policy Updates via Central Management Console

  • Scenario: The IT Security team schedules a weekly update of antivirus definitions and heuristic signatures using CrowdStrike Falcon or Microsoft Defender for Endpoint. During this process, the management server pushes new IOCs (hashes and file paths) to all endpoints. If the SmartApeSG IOC list contains generic hash values that overlap with these signature files or the updater executable itself, the rule triggers across hundreds of workstations simultaneously.
  • Suggested Filter: Exclude traffic originating from the specific IP ranges of the Endpoint Management Servers (e.g., 10.50.20.0/24) and filter out events where the process name matches known update agents (e.g., CdpUpdate.exe, MsMpEng.exe, or FalconSensor.exe).

• Automated Software Deployment via Configuration Management

  • Scenario: The DevOps team utilizes Ansible or SCCM (System Center Configuration Manager) to deploy a new internal productivity suite. The deployment package includes a pre-installed security module that downloads and verifies specific DLLs from an internal repository. If the SmartApeSG detection logic flags the SHA-256 hash of these standard library files or the deployment script itself as a known threat, it generates alerts for every machine in the target collection during the maintenance window (e.g., Sundays 02:00–04:00).
  • Suggested Filter: Create an exclusion based on the “Scheduled Task” name (e.g., SCCM_Install_Task or Ansible_Software_Deployment) and whitelist the specific file hashes of the internal deployment package artifacts.

• **Third-