ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hunt targets adversary activity involving four specific indicators of compromise linked to the SmartApeSG campaign, which often signal early-stage reconnaissance or lateral movement within cloud environments. Proactively hunting for these IOCs in Azure Sentinel is critical because their high severity suggests a sophisticated threat actor that may bypass standard signature-based defenses, requiring manual correlation across network and endpoint logs to confirm potential breaches.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 4 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["hazelcompass.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://hazelcompass.top/realm/reset-request.js", "https://hazelcompass.top/realm/tenant-thread", "https://hazelcompass.top/realm/user-runtime.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SmartApeSG IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the “Quarantine” folder on file servers. This folder contains archived, benign samples previously flagged by other vendors but cleared as false positives. These archives may contain embedded hashes matching SmartApeSG IOCs (specifically PDFs or Office documents with known macros) that are no longer active threats in this specific environment.
  • Filter/Exclusion: Exclude alerts originating from the C:\ProgramData\Antivirus\Quarantine directory path and filter by process name csagent.exe (CrowdStrike) or MsMpEng.exe (Defender) where the file age is greater than 30 days.

• Software Deployment via Configuration Management

  • Scenario: The IT Operations team utilizes Ansible or Microsoft SCCM (Configuration Manager) to deploy a standardized “Security Toolkit” image to new workstations. This toolkit includes legacy documentation and sample configuration files sourced from the vendor’s public repository, which inadvertently contain the specific IOCs associated with SmartApeSG. During the initial deployment phase on Day 1 of a user’s onboarding, these files are extracted and executed by the deployment agent.
  • Filter/Exclusion: Create an exclusion rule for file paths matching C:\Program Files\DeploymentToolkit\Samples and restrict alerts to only trigger if the parent process is not ccmexec.exe (SCCM) or ansible-runner. Additionally, whitelist the specific SHA-256 hashes of these known deployment artifacts.

• **Automated Vulnerability Assessment