ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This hypothesis targets the presence of DarkTortilla malware, which establishes persistence and exfiltrates sensitive data through compromised credentials or exploit kits. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections via unusual outbound traffic or unexpected processes, mitigating the risk of data loss before the adversary achieves full control.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`750343b29466f6258ae1d26c00fcbd3e98f2000d80eb9d2ad9496e9fda5c422f`	payload	2026-09-05	95%
sha1_hash	`1bd1099ae886df044bd5c1f1a1a5f17344708070`	payload	2026-09-05	95%
md5_hash	`ed2972345edb2d887052dccaff556aa8`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["750343b29466f6258ae1d26c00fcbd3e98f2000d80eb9d2ad9496e9fda5c422f", "1bd1099ae886df044bd5c1f1a1a5f17344708070", "ed2972345edb2d887052dccaff556aa8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Legitimate Phishing Campaign Testing (e.g., GoPhish or KnowBe4)
- Scenario: Security teams regularly conduct internal phishing simulations using tools like GoPhish or KnowBe4. These platforms often generate unique, dynamic URLs or attachment hashes that may overlap with known DarkTortilla IOCs (such as specific C2 domains or file hashes) to test endpoint detection capabilities.
- Filter/Exclusion: Exclude alerts where the source user account belongs to the Phishing-Sim-Team security group, or filter out events where the initiating process is gophish-agent.exe or knowbe4-agent.exe.
Scheduled Third-Party Software Updates (e.g., Adobe Flash, Java, or Chrome Auto-Update)
- Scenario: DarkTortilla is known to arrive via compromised third-party software updates. Legitimate enterprise environments frequently run scheduled tasks for auto-updating critical software (e.g., Adobe Acrobat, Java JRE, or Google Chrome). If an update package is signed by a trusted vendor but has a hash that matches a newly published DarkTortilla IOC (due to rapid IOC rotation or false hash collision), the rule may trigger.
- Filter/Exclusion: Exclude alerts where the parent process is a known updater service (e.g., AdobeUpdateService.exe, javaw.exe from the JRE directory, or chrome.exe running the --type=utility process) and the file path resides in standard vendor installation directories (e.g., C:\Program Files\Adobe\, C:\Program Files\Java\).
Credential Harvesting via Enterprise Password Managers (e.g., 1Password, Bitwarden)
- Scenario: DarkTortilla exfiltrates sensitive data and stolen credentials. In legitimate environments, employees use enterprise password managers (like