ThreatFox: SmartApeSG IOCs

Hunt Hypothesis

This hypothesis detects adversary activity by correlating network and endpoint telemetry against 14 specific indicators of compromise (IOCs) linked to the SmartApeSG threat actor. Proactive hunting for these IOCs within Azure Sentinel is critical to identify early-stage intrusions from this high-severity campaign before they escalate into broader data exfiltration or lateral movement events.

IOC Summary

Malware Family: SmartApeSG Total IOCs: 14 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SmartApeSG
let malicious_domains = dynamic(["belfryledger.top", "olivenarthex.top", "umbergalleon.top", "loggiaelm.top", "pergolamimosa.top", "brightdeltazone.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - SmartApeSG
let malicious_urls = dynamic(["https://willowgazette.top/callback/beta-ajax.js", "https://belfryledger.top/callback/beta-ajax.js", "https://olivenarthex.top/middleware/api-script.js", "https://umbergalleon.top/status/alias-build.js", "https://loggiaelm.top/realm/reset-response.js", "https://pergolamimosa.top/alias/settings-render.js", "https://brightdeltazone.top/legacy/proxy-util.php", "https://hornbeamcairn.top/endpoint/handler-stylesheet.js"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SmartApeSG

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: SmartApeSG IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Endpoint Security Updates

  • Context: The organization uses CrowdStrike Falcon or Microsoft Defender for Endpoint. During nightly maintenance windows (e.g., 02:00 AM), the endpoint protection service automatically queries external intelligence feeds to update its local IOC database. This process generates network traffic matching the SmartApeSG IP addresses as part of a routine health check or signature sync, rather than active malicious activity.
  • Suggested Filter/Exclusion: Create an exclusion rule that suppresses alerts for this specific detection if the source process is FalconSensor.exe (CrowdStrike) or MsMpEng.exe (Defender) AND the event occurs between 01:00 and 04:00 local time.

• Scenario: Admin-Initiated Threat Intelligence Ingestion

  • Context: A Security Operations Center (SOC) analyst manually imports a new threat intelligence feed containing SmartApeSG indicators into the SIEM or EDR console via an administrative script using PowerShell. The script (Import-ThreatIntel.ps1) runs on a dedicated management server and triggers network connections to the SmartApeSG IOCs as part of the ingestion workflow, mimicking a compromised host behavior.
  • Suggested Filter/Exclusion: Exclude alerts where the source hostname matches the pattern MGT-SIEM-01 through MGT-SIEM-05 and the initiating user account is a member of the Security_Admins group with the process name containing “PowerShell”.

• Scenario: Cloud Backup Service Connectivity

  • Context: The enterprise utilizes Veeam Backup & Replication to manage off