ThreatFox: Amadey IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by correlating three specific Indicators of Compromise (IOCs) linked to the Amadey threat intelligence feed within Azure Sentinel. Proactively hunting for these signals is critical because early identification of known malicious artifacts enables the SOC team to rapidly contain potential breaches before they escalate into widespread incidents.

IOC Summary

Malware Family: Amadey Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`c5616af2cef3dcdb095d8cc55db75c96`	payload	2026-08-28	95%
sha256_hash	`76e6367d8123171afa540fe92a3758424ec7d1e029c4e5a3b9771e24fe0085c1`	payload	2026-08-28	95%
sha1_hash	`3c584320e4f7523645ed71d09321d2f5a476f103`	payload	2026-08-28	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Amadey
let malicious_hashes = dynamic(["c5616af2cef3dcdb095d8cc55db75c96", "76e6367d8123171afa540fe92a3758424ec7d1e029c4e5a3b9771e24fe0085c1", "3c584320e4f7523645ed71d09321d2f5a476f103"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Amadey

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Amadey IOCs detection rule, along with targeted filters and exclusions:

Scenario: Scheduled Endpoint Protection Updates via Amadey Console
- Context: The enterprise utilizes Amadeus Endpoint Security (formerly K7 Computing) or a similar suite where the central management console pushes definition updates. This triggers network connections to known Amadey update servers, matching the IOCs in the rule.
- Filter/Exclusion: Create an exclusion based on the source process name amadeus_agent.exe (or specific service PID) and restrict the alert scope to traffic destined for the official Amadey update domain list (e.g., *.amadeus.com, *.k7computing.com).
Scenario: Automated Patch Deployment by Admin via SCCM
- Context: System Administrators use Microsoft Endpoint Configuration Manager (SCCM/MECM) to deploy a specific security patch or configuration script that invokes an Amadey verification tool. The deployment job generates network traffic matching the IOCs during the maintenance window.
- Filter/Exclusion: Exclude alerts where the source process is ccmexec.exe and the execution occurs within the defined maintenance window (e.g., 02:00–04:00 UTC). Alternatively, whitelist the specific SCCM collection name “Security_Patch_Deployment”.
Scenario: Third-Party Backup Solution Integration
- Context: The organization uses Veeam Backup & Replication, which has a built-in integration module for Amadey to ensure backup integrity. During nightly backup jobs, the Veeam service communicates with Amadey IOCs to verify file signatures before archiving.
- Filter/Exclusion: Filter out alerts where the initiating process is `