ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt detects adversary activity by identifying network connections or file executions matching specific Indicators of Compromise (IOCs) linked to the SmartApeSG threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity threat enables rapid containment and prevents potential lateral movement within the organization’s cloud infrastructure.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["rowanportico.global"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://rowanportico.global/identity/realm-xml.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Security Information & Event Management (SIEM) Ingestion of Threat Intelligence Feeds

  • Context: The enterprise SIEM (e.g., Splunk or Microsoft Sentinel) is configured to ingest daily threat intelligence feeds from third-party vendors. If the SmartApeSG IOC list is part of a broader “Global Threat Feed” subscription, the ingestion process itself will generate network traffic or file hashes matching the rule’s IOCs without any actual malicious activity occurring on endpoints.
  • Filter/Exclusion: Exclude traffic originating from the specific IP addresses or hostnames of the SIEM collector nodes (e.g., splunk-indexer-01, sentinel-data-collector) and restrict the detection scope to exclude ports used for feed ingestion (typically 443 or custom API ports) during scheduled maintenance windows.

• Scenario: Automated Endpoint Protection Policy Updates

  • Context: The organization uses CrowdStrike Falcon or Microsoft Defender for Endpoint. During a nightly policy synchronization, the endpoint agents download updated signature databases that include SmartApeSG indicators as part of a “Recommended Block List.” This triggers the detection rule when the agent writes the new IOC list to disk or initiates a network handshake with the update server.
  • Filter/Exclusion: Create an exclusion for processes belonging to the endpoint protection suite (e.g., FalconSensor.exe, MsMpEng.exe) and filter out events where the process command line contains keywords like “update,” “sync,” or “policy-refresh.”

• Scenario: Scheduled Security Scan Jobs via PowerShell

  • Context: An internal security team runs a scheduled PowerShell job (Task Scheduler) every Tuesday at 0