ThreatFox: Tsundere IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the specific set of 14 Indicators of Compromise (IOCs) linked to the Tsundere threat actor to identify active reconnaissance or initial access attempts within the network. Proactively hunting for these signatures in Azure Sentinel is critical due to the high severity rating, enabling the SOC team to detect and contain potential Tsundere campaigns before they escalate into broader lateral movements or data exfiltration events.

IOC Summary

Malware Family: Tsundere Total IOCs: 14 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tsundere
let malicious_ips = dynamic(["91.92.43.193", "82.25.63.130", "91.92.43.196", "199.91.220.216", "91.92.43.195", "89.125.153.29", "82.25.63.124", "91.92.43.194", "193.24.123.25", "185.45.193.84", "138.124.240.76", "138.124.240.77", "199.217.99.189"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.43.193", "82.25.63.130", "91.92.43.196", "199.91.220.216", "91.92.43.195", "89.125.153.29", "82.25.63.124", "91.92.43.194", "193.24.123.25", "185.45.193.84", "138.124.240.76", "138.124.240.77", "199.217.99.189"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Tsundere

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Tsundere IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the “Quarantine” folder. This folder contains archived samples from previous threat hunts, including historical Tsundere malware variants that were previously identified and isolated but not deleted. The scanner generates network traffic or file access events matching the 14 IOCs (hashes, URLs, or domains) as it re-indexes these benign, known files.
  • Filter/Exclusion: Exclude alerts where the source process is the endpoint agent itself (e.g., C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe) and the file path resides within a designated “Quarantine” or “Archive” directory structure.

• Security Information & Event Management (SIEM) Log Ingestion

  • Scenario: The SIEM platform (e.g., Splunk Enterprise Security or Microsoft Sentinel) ingests logs from the corporate firewall and proxy. During a routine log parsing job, the system processes historical traffic logs that include connections to Tsundere-related domains used by internal security dashboards or threat intelligence feeds. These legitimate management connections trigger the IOC match logic even though no active infection is occurring on endpoints.
  • Filter/Exclusion: Create an exclusion for traffic originating from specific “Management” subnets (e.g., 10.20.50.0/24) or where the destination port corresponds to internal SIEM ingestion services, provided the user agent string matches known security tool identifiers.

• Software Deployment via Configuration Management Tools