ThreatFox: Chaos IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Chaos threat actor by monitoring specific Indicators of Compromise (IOCs) that signal potential initial access or command-and-control communications. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised assets and mitigate the high-severity risks posed by this sophisticated threat group before lateral movement occurs.

IOC Summary

Malware Family: Chaos Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Chaos
let malicious_ips = dynamic(["95.216.220.204", "31.56.209.245"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.216.220.204", "31.56.209.245"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Chaos

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Chaos IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Microsoft Defender

  • Context: The Chaos threat often utilizes specific hash signatures or network patterns that overlap with legitimate update mechanisms. In many enterprises, the scheduled daily definition update for Microsoft Defender for Endpoint triggers a connection to update servers that match the IOCs associated with Chaos (e.g., specific TLS fingerprints or IP ranges).
  • Filter/Exclusion: Create an exclusion rule based on the process name MpCmdRun.exe and MsMpEng.exe. Additionally, exclude traffic originating from the internal subnet range dedicated to update servers (e.g., 10.20.50.0/24) during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Automated Backup Jobs Using Veeam or Commvault

  • Context: Enterprise backup solutions like Veeam Backup & Replication often initiate high-volume data transfers to cloud repositories. The IOCs for Chaos may include specific User-Agent strings or port usage patterns that mimic the behavior of these backup agents establishing connections to external storage buckets (e.g., AWS S3 or Azure Blob), triggering a false alert on “suspicious network activity.”
  • Filter/Exclusion: Filter alerts where the source process is VeeamAgent.exe or CommServe.exe. Implement a logic check that suppresses the rule if the destination port is standard backup traffic (e.g., Port 443 with high throughput >50MB/s) and the connection duration exceeds 15 minutes, which is typical for full backups but atypical for initial Chaos reconnaissance.

• **Scenario: CI/