ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt targets the presence of known SmartApeSG indicators of compromise to identify potential intrusions by this threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because SmartApeSG is associated with high-severity threats, enabling the SOC to detect and contain lateral movement or persistence mechanisms before they escalate into a full breach.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["larchfable.cloud"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://yewanthology.co/rate/settings-compiler.js", "https://larchfable.cloud/verify/api-theme.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

• Scenario: A security operations team or threat intelligence platform (e.g., Cortex XDR, Splunk) automatically ingests and correlates the SmartApeSG IOC list (IPs, domains, hashes) into the SIEM or EDR for historical hunting. This process often involves creating temporary files, executing analysis scripts, or generating logs that match the specific IOCs (e.g., a domain lookup for smartapesg.com or a file hash match) as part of the ingestion workflow.

  • Filter/Exclusion: Exclude events where the source process is a known threat intelligence ingestion agent (e.g., cortex-xdr-agent.exe, splunkd.exe, or python.exe running from the TI integration directory) or where the user account is a dedicated service account for threat intelligence (e.g., svc-threatintel).

• Scenario: An IT administrator or security engineer manually tests the SmartApeSG detection logic by using a tool like nslookup, ping, or a custom PowerShell script to verify that the blocklist or alerting rule is functioning correctly. This legitimate testing activity generates network connections or file accesses that match the IOCs.

  • Filter/Exclusion: Exclude events where the source process is a common network diagnostic tool (nslookup.exe, ping.exe, curl.exe) or a scripting host (powershell.exe, pwsh.exe) executed by an administrative user account (e.g., admin-*, svc-itops) during known maintenance windows or testing periods.

• Scenario: A developer or DevOps engineer is working on a new application or service that uses a third-party library or SDK which happens to share a common hash or domain name with one of the SmartApeSG IOCs (a rare but possible collision, or the library is a known component used in the SmartApeSG ecosystem for legitimate purposes). The application startup or