ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious infrastructure associated with the DarkTortilla campaign communicates with internal assets via specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage reconnaissance or command-and-control activity before it escalates into a confirmed breach.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`68c9207a1e4e703b897300fc6c21cf0472549b352d80a64259e21ed4fdfe63a4`	payload	2026-07-16	95%
sha1_hash	`54f998f02bb83c71a0746cd38ca8203ed9a90a3a`	payload	2026-07-16	95%
md5_hash	`1f017ca7bcdae763c27483193017747a`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["68c9207a1e4e703b897300fc6c21cf0472549b352d80a64259e21ed4fdfe63a4", "54f998f02bb83c71a0746cd38ca8203ed9a90a3a", "1f017ca7bcdae763c27483193017747a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DarkTortilla IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Security Operations Center (SOC) Threat Intelligence Ingestion
- Scenario: The automated threat intelligence platform (e.g., Splunk Enterprise Security, Microsoft Sentinel, or CrowdStrike Falcon) periodically pulls the latest DarkTortilla IOC feed from ThreatFox to update its internal database. This process triggers the detection logic as if a new infection is occurring, even though it is a controlled data sync task running on a dedicated management server.
- Filter/Exclusion: Add an exclusion based on the Source IP (the SOC ingestion server) and the Process Name (e.g., splunkd.exe, SentinelAgent.exe, or CrowdStrikeService.exe). Alternatively, filter out events where the User Account is a service account specifically used for threat intelligence updates (e.g., svc-threat-ingest).
Endpoint Detection and Response (EDR) Scheduled Scans
- Scenario: The enterprise EDR solution (such as Trend Micro Deep Security, Carbon Black, or Symantec Endpoint Protection) performs a scheduled “YARA” or signature-based scan against the DarkTortilla IOC set. During this scan, the agent generates alerts for every match found in the file system to validate its own detection capabilities, creating noise that mimics active threats on user workstations and servers.
- Filter/Exclusion: Exclude events where the Parent Process is the EDR scanning engine (e.g., TmAgent.exe, cb.exe, or Symantec Antivirus Console) and the Event Type indicates a “Scan” or “Policy Check” rather than an “Execution” or “Network