ThreatFox: Xloader IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the Xloader dropper to establish persistence and exfiltrate sensitive data via three specific Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical because early detection of this initial infection stage allows SOC teams to isolate compromised endpoints before lateral movement or advanced payload delivery occurs.

IOC Summary

Malware Family: Xloader Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`d76b3e385a5f85b7c2a547ee7053342c`	payload	2026-07-14	95%
sha256_hash	`13eabc99acd666de32c3db953f8416543a3fa7f86a18b922adda6f3b1045ab1d`	payload	2026-07-14	95%
sha1_hash	`bace6a7c8b3a6df67feb7af9e7ead11a17505697`	payload	2026-07-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Xloader
let malicious_hashes = dynamic(["d76b3e385a5f85b7c2a547ee7053342c", "13eabc99acd666de32c3db953f8416543a3fa7f86a18b922adda6f3b1045ab1d", "bace6a7c8b3a6df67feb7af9e7ead11a17505697"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Xloader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Xloader IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Endpoint Security Agent Updates via Microsoft Endpoint Configuration Manager (MECM/SCCM)
- Scenario: The organization uses SCCM to distribute security updates. During a scheduled maintenance window, the SCCM client initiates a background download of the latest Xloader signature database or engine update package from an internal distribution point. This process generates network traffic matching the Xloader IOCs (specifically known benign hash values and communication with trusted update servers) which may be misidentified as active threat hunting signals.
- Filter/Exclusion: Exclude traffic originating from SCCM client processes (ccmexec.exe or Wuauserv) communicating with internal IP ranges designated for Software Update Points (SUPs). Additionally, whitelist the specific SHA-256 hashes of the known update installer packages used in your environment.
Automated Threat Intelligence Feed Ingestion by SIEM Connectors
- Scenario: The enterprise Security Information and Event Management (SIEM) system runs a scheduled job (e.g., via Python scripts or PowerShell tasks on a dedicated management server) to pull the latest Xloader IOC feeds from the vendor’s API for enrichment. This ingestion process involves HTTP/HTTPS requests to external ThreatFox endpoints that match the detection logic, triggering alerts despite being an administrative data collection task rather than endpoint infection.
- Filter/Exclusion: Create a rule exclusion based on the source IP address of the SIEM management server and the specific user account running the scheduled job (e.g., svc-threat-ingest). Filter out events where the process name is the script runner (e.g., python.exe, powershell.exe) executing the known ingestion script path.
Third-Party Cloud Backup Agent Synchronization