← Back to SOC feed Coverage →

ThreatFox: Tsundere IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
iocjs-tsunderethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-15T11:00:00Z · Confidence: high

Hunt Hypothesis

This detection rule identifies adversary behavior where the Tsundere malware family establishes covert command-and-control channels to exfiltrate sensitive data from the environment. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of this high-severity threat prevents prolonged data exposure and limits the attacker’s ability to maintain persistent access within the network.

IOC Summary

Malware Family: Tsundere Total IOCs: 2 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port91[.]92[.]43[.]103:80botnet_cc2026-08-1475%
ip:port2[.]27[.]248[.]16:80botnet_cc2026-08-1475%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["91.92.43.103", "2.27.248.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.43.103", "2.27.248.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Tsundere IOCs detection rule, including suggested filters or exclusions tailored to an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/js.tsundere/