ThreatFox: Ave Maria IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known Ave Maria indicators of compromise to establish persistence or execute initial reconnaissance within the Azure environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify and contain potential early-stage intrusions before they escalate into broader lateral movements.

IOC Summary

Malware Family: Ave Maria Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ave Maria
let malicious_ips = dynamic(["178.173.244.189"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.173.244.189"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Ave Maria
let malicious_domains = dynamic(["morefunds.ddns.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Ave Maria

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Ave Maria IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scheduled Antivirus Definition Updates via WSUS/SCCM

  • Scenario: Enterprise endpoints regularly download and install security definition updates from internal repositories. If the “Ave Maria” threat family includes a specific hash or domain used by a third-party AV vendor (e.g., CrowdStrike, SentinelOne) that is being pushed via Microsoft Endpoint Configuration Manager (MECM/SCCM), legitimate update tasks will trigger the IOC match.
  • Filter/Exclusion: Create an exclusion for traffic originating from internal IP ranges associated with the Software Update Point or WSUS servers. Additionally, filter out events where the process name matches known AV update executables (e.g., ccSetSvc.exe, CCMExec.exe) and the destination port is 443/80 to the specific update domain.

• IT Admin Manual Remediation Scripts

  • Scenario: Security Operations or System Administrators frequently run PowerShell scripts to remediate known vulnerabilities across the fleet. If an admin executes a script that queries an external threat intelligence feed or downloads a patch file containing an “Ave Maria” signature hash (perhaps for testing purposes), the detection engine flags this as a potential threat interaction.
  • Filter/Exclusion: Implement a rule to exclude events generated by service accounts used for administration (e.g., svc-it-admin, domain\backup-service) and processes running under the PowerShell.exe or cmd.exe command line with arguments containing “remediation,” “patch,” or specific script paths located in secure administrative directories (e.g., C:\Scripts\Remediation).

• Third-Party Cloud SaaS Integration Syncs

  • Scenario: The organization utilizes cloud