ThreatFox: AMOS IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating network and endpoint telemetry against ten specific Indicators of Compromise (IOCs) linked to the AMOS threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of AMOS-related artifacts enables rapid containment before the threat actor can establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: AMOS Total IOCs: 10 IOC Types: sha256_hash, ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AMOS
let malicious_ips = dynamic(["192.162.199.249"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.162.199.249"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["http://192.162.199.249/tzb10mmujurn", "http://192.162.199.249/y6b3fuzj0w6pt97e", "http://192.162.199.249/8w6vq50fsu", "http://192.162.199.249/8jot5vdohds0imt4", "http://192.162.199.249/1edjop4tlj2d", "http://192.162.199.249/zeb8cgwmkkpvu7pc", "http://192.162.199.249/ezaenul9", "http://192.162.199.249/1vo6lm4y50k3ww0f"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["275aeaa88d853ddb93c6e3c102beb1aa2ba41ca1b68af25b47781d9f4460bc5d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: AMOS IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated AV Definition Updates via Microsoft Defender

  • Context: The endpoint protection engine (Microsoft Defender Antivirus) automatically downloads and installs new virus definition updates. These updates often contain signatures or hash values that overlap with known AMOS IOCs, triggering the rule when the update service (SenseiService or DefenderSvc) connects to the update server.
  • Filter/Exclusion: Exclude network traffic originating from the Microsoft Update service process (MsMpEng.exe) where the destination is a trusted Microsoft CDN IP range (e.g., *.update.microsoft.com). Alternatively, create an exclusion for the specific file hash of the latest definition package if it matches the IOC.

• Scenario: Scheduled Enterprise Backup Jobs

  • Context: Nightly backup jobs executed by tools like Veeam or Commvault scan large datasets and generate temporary log files or checksums. If the backup agent generates a file with a hash matching an AMOS IOC (often due to shared library dependencies), the rule triggers during the scheduled maintenance window (e.g., 02:00–04:00 UTC).
  • Filter/Exclusion: Apply a time-based filter to suppress alerts generated between 01:00 and 05:00 local time for processes belonging to backup agents (Veeam.Backup.Service.exe, commvault.cmd). Additionally, exclude file paths located within the designated backup staging directory (e.g., C:\ProgramData\Veeam\Backup\Staging\).

• Scenario: Software Deployment via SCCM/Intune

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Intune pushes application updates to