ThreatFox: MacSync IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the MacSync malware, which often leverages browser extensions to exfiltrate sensitive data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary can establish persistent access or steal credentials.

IOC Summary

Malware Family: MacSync Total IOCs: 7 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - MacSync
let malicious_ips = dynamic(["164.90.161.147"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["164.90.161.147"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - MacSync
let malicious_domains = dynamic(["cli-desktop.com", "fern-plume.com", "node-slate.com", "jadeleap15.com", "loop-lumen.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — MacSync

False Positive Guidance

• Scenario: An IT administrator performs a manual disk cleanup or archive rotation on a shared network drive, moving old log files or backup archives (which may contain specific hash values or filenames from the MacSync IOC list) into a “Cold Storage” or “Archive” folder.
  • Filter/Exclusion: Exclude alerts where the file path contains \\[server]\archive, \\[server]\cold_storage, or C:\Backups\ and the action is Move or Copy rather than Create or Modify.
• Scenario: A development team uses a CI/CD pipeline (e.g., Jenkins or Azure DevOps) that downloads specific open-source libraries or dependency packages during a build step. If one of these packages happens to match a known MacSync IOC hash or filename (e.g., sync_helper.dll or similar generic names), it will be written to the build workspace.
  • Filter/Exclusion: Exclude alerts originating from service accounts associated with CI/CD systems (e.g., svc-jenkins, azure-devops-agent) or where the file path includes /workspace/, /build/, or /temp/.
• Scenario: An endpoint detection tool or anti-malware agent (e.g., CrowdStrike, Defender for Endpoint) quarantines a known benign file that was previously flagged as suspicious but later whitelisted. The quarantine process may move the file to a specific quarantine folder, triggering a “file created” or “file modified” event that matches the IOC.
  • Filter/Exclusion: Exclude alerts where the destination path contains Quarantine, Isolated, or Defender\Quarantine, and the source process is a known EDR/AV agent executable.
• Scenario: A user installs a legitimate third-party application that bundles a helper component or installer script with a