ThreatFox: Formbook IOCs

Hunt Hypothesis

This hypothesis targets the presence of Formbook malware, a data-stealer that injects into browser processes to exfiltrate credentials and banking information via command-and-control channels. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as the malware’s stealthy injection technique and high severity pose a significant risk to sensitive data integrity and organizational security.

IOC Summary

Malware Family: Formbook Total IOCs: 15 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["210c94d2fc3ffd7cb7ee6e51c78c9a85f49cd213cb0a24e79f8976f284beea49", "2f2356b0856da11245aaa34acfd34c1e8c3f8cb8", "67cfe6d11110f707c0ab1db18df76cfb", "abb0055779e755aed3f7f8a4492925fb", "540d2e577848b2f18d2037e51ccd1beea6d974e0fb6bcc545a45573a5c0e790d", "3551ce6f866465b30412b1e06d922eadc015e63f", "f1688cb2537bd105e74c921e78c90cb7", "6e622a0494a87ab3882598c63f512391b5ce9226e5af6a84ab773d1355757eb2", "5afef3bb8a3ba23d8111529b511a09d10dcaee4f", "7f1a28936f529e3d10244d3d81e604bd", "266557d164f6d7c5e9c017df90d75359f22d88e28ae8d3859c06e36316581abd", "40b4472c26257f872cf58713c987ed00c3d99932", "d59ae2bb7c7b0e2197249fb8b45e75a764b0b3bb0a2798d92f7053122a98852d", "cf080b7b59bb1b31b1093f0ed9c5795ac76214e8", "b8a377be5d0b06abb2326267510c98a9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Formbook

False Positive Guidance

• Scenario: A security operations center (SOC) engineer performs a manual threat hunt or incident response investigation by downloading a known Formbook sample (or its hash) from a public repository like VirusTotal or MalShare to analyze its behavior in a sandbox or isolated VM. The detection engine identifies the file hash or memory signature as a known Formbook IOC.

  • Filter/Exclusion: Exclude files located in specific incident response directories (e.g., C:\IR\Incidents\2024-05-12_Formbook_Analysis\) or exclude processes running under a dedicated service account (e.g., svc-threat-hunt) when the parent process is a known analysis tool (e.g., Sysinternals\Procmon.exe or Wireshark.exe).

• Scenario: An IT administrator uses a third-party endpoint detection and response (EDR) console or a security scanner (e.g., CrowdStrike Falcon, Carbon Black, or Trend Micro Apex One) that maintains an internal signature database including Formbook IOCs. The scanner’s agent process may temporarily load or reference Formbook signatures in memory or create temporary cache files that match the rule’s hash or string patterns.

  • Filter/Exclusion: Exclude events where the parent process is a known EDR agent (e.g., FalconSensor.exe, cb.exe, TmService.exe) or where the file path contains common EDR cache directories (e.g., C:\ProgramData\CrowdStrike\, C:\ProgramData\Bitdefender\).

• Scenario: A development team uses a containerized CI/CD pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) to build and test a web application that includes a JavaScript-based credential harvesting module for a customer-facing banking portal. The build process extracts or compiles a test artifact that shares a similar code pattern