This detection rule identifies adversary behavior where the Tsundere malware family establishes covert command-and-control channels to exfiltrate sensitive data from the environment. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of this high-severity threat prevents prolonged data exposure and limits the attacker’s ability to maintain persistent access within the network.
Malware Family: Tsundere Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]43[.]103:80 | botnet_cc | 2026-08-14 | 75% |
| ip:port | 2[.]27[.]248[.]16:80 | botnet_cc | 2026-08-14 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["91.92.43.103", "2.27.248.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.43.103", "2.27.248.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Tsundere IOCs detection rule, including suggested filters or exclusions tailored to an enterprise environment:
Scenario: Automated Cloud Backup Synchronization
svc-veeam-backup) running on backup servers (SVR-BACKUP-01, SVR-BACKUP-02). Additionally, exclude destination IP ranges belonging to known cloud providers (e.g., *.amazonaws.com, *.azure.com) when the source is a designated backup subnet.Scenario: Scheduled Software Update Deployment
DP-01, DP-02) destined for the update repository IP addresses. Implement a time-based filter to suppress alerts between 02:00 and 06:00 UTC, coinciding with the standard maintenance window defined in Group Policy.Scenario: Third-Party SaaS Data Ingestion