ThreatFox: Chaos IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Chaos threat actor by monitoring for three specific Indicators of Compromise (IOCs) that signal potential intrusion or data exfiltration efforts. A proactive hunt in Azure Sentinel is essential because early identification of these high-severity IOCs allows the SOC team to rapidly isolate affected assets and mitigate the impact before the adversary establishes a persistent foothold within the environment.

IOC Summary

Malware Family: Chaos Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`31[.]76[.]100[.]3:443`	botnet_cc	2026-08-29	75%
ip:port	`31[.]76[.]100[.]3:80`	botnet_cc	2026-08-29	75%
ip:port	`94[.]184[.]37[.]68:8080`	botnet_cc	2026-08-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Chaos
let malicious_ips = dynamic(["31.76.100.3", "94.184.37.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.76.100.3", "94.184.37.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Chaos

False Positive Guidance

False Positive Scenarios for “ThreatFox: Chaos IOCs”

Scenario: Scheduled Antivirus Definition Updates
- Context: The enterprise’s endpoint protection suite, CrowdStrike Falcon, automatically downloads and installs new definition updates every Tuesday at 02:00 AM. This process triggers the specific hash and network connection patterns associated with the “Chaos” IOCs as part of its update mechanism.
- Filter/Exclusion: Create a detection rule exclusion for traffic originating from the CrowdStrike management server IP range (192.168.10.50-55) during the scheduled maintenance window (Tuesday 02:00–04:00). Alternatively, exclude process names containing FalconSensor.exe when matching the specific IOCs.
Scenario: Automated Patch Deployment via SCCM
- Context: The IT Operations team utilizes Microsoft Endpoint Configuration Manager (SCCM) to deploy monthly security patches. During the deployment phase, the SCCM client service (ccmexec.exe) establishes connections to the internal patch repository and external vendor feeds that mimic the network signatures of the Chaos threat family.
- Filter/Exclusion: Implement a filter to suppress alerts where the source process is ccmexec.exe running under the context of the “System” or “Network Service” account, specifically when the destination port matches the standard SCCM communication ports (8530-8531).
Scenario: Legacy Backup Job Execution
- Context: A nightly backup job managed by Veeam Backup & Replication runs at 23:00. The Veeam transport service initiates a large data transfer to the cloud repository, generating network flows and file hashes that overlap with the Chaos IOCs due to similar encryption signatures used in the backup stream