This hunt detects adversary behavior involving specific Indicators of Compromise (IOCs) linked to the Tsundere threat actor, which often signifies early-stage reconnaissance or lateral movement activities within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify potential Tsundere intrusions before they escalate into broader data exfiltration or system compromise events.
Malware Family: Tsundere Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]43[.]103:80 | botnet_cc | 2026-08-14 | 75% |
| ip:port | 2[.]27[.]248[.]16:80 | botnet_cc | 2026-08-14 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["2.27.248.16", "91.92.43.103"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.27.248.16", "91.92.43.103"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Tsundere IOCs detection rule:
Scenario: Scheduled Malware Definition Updates via Defender for Endpoint
go.microsoft.com or specific CDN endpoints. If the update package includes a hash that matches a Tsundere IOC, the rule triggers despite being a trusted administrative task.MsMpEng.exe (Microsoft Antimalware Service Executable) and restrict the detection to only trigger when the source IP is not within the Microsoft Azure CDN range (13.0.0.0/8, 20.0.0.0/8). Alternatively, whitelist the specific file hash of the update package if it remains static across environments.Scenario: Automated Software Deployment via SCCM or Intune
ccmexec.exe or IntuneManagementExtension.exe) downloads the installer from an internal distribution point that hosts a file with a hash matching the Tsundere IOC, often used as a test artifact in the deployment library.ccmexec.exe or Microsoft.IntuneManagementExtension.exe. Additionally, add a filter to ignore events originating from internal IP ranges designated for Distribution Points (e.g., 10.20.0.0/16) unless the destination port indicates an external internet connection.Scenario: Backup and Archiving Jobs via Veeam or Commvault