ThreatFox: Amadey IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known Amadey malware indicators to detect potential banking trojan infections within the organization’s Azure environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because Amadey’s ability to steal credentials and modify system configurations necessitates early identification before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Amadey Total IOCs: 2 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Amadey
let malicious_ips = dynamic(["47.236.116.9"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.236.116.9"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Amadey
let malicious_urls = dynamic(["http://47.236.116.9/y8jdGc5jS/index.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Amadey

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Amadey IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Endpoint Protection Updates via WSUS/SCCM

  • Scenario: The organization’s patch management system (e.g., Microsoft SCCM or WSUS) pushes a security definition update to the C:\ProgramData\Microsoft\Windows Defender directory. This process involves downloading and extracting files that match Amadey IOCs, specifically when the vendor is distributing a new signature pack for their own “Amadey” detection module or a third-party tool with overlapping hash signatures.
  • Suggested Filter: Exclude network traffic and file creation events originating from known management servers (e.g., SCCM-Server01, WSUS-Hub) where the process name is ccmexec.exe or wuauclt.exe. Additionally, filter out file paths containing \Microsoft\Windows Defender\Platform\ or specific hash values that are part of the approved “Baseline” signature list.

• IT Admin Deployment of Security Agents via PowerShell

  • Scenario: An IT administrator runs a scheduled PowerShell script (Invoke-WebRequest followed by Expand-Archive) to deploy a new version of a security agent or a threat intelligence feed parser across 500 workstations. The script downloads an installer package from the internal repository that contains a file hash identical to one of the Amadey IOCs, triggering the hunt package alert during the installation phase.
  • Suggested Filter: Create an exclusion for process trees where the parent process is powershell.exe or pwsh.exe and the command line arguments contain specific internal repository URLs (e.g., internal-repo.company.com/updates). Exclude events occurring within a defined maintenance window (e.g., 02:00–