ThreatFox: Formbook IOCs

Hunt Hypothesis

This hunt detects Formbook data-stealing malware that exfiltrates sensitive credentials and banking information through covert C2 channels following initial infection via phishing emails. A proactive search in Azure Sentinel is critical to identify early-stage lateral movement and prevent the loss of high-value financial assets before the adversary establishes persistent access.

IOC Summary

Malware Family: Formbook Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`729f56d9643c97fa9d9fb4a7696df881cbe0321b`	payload	2026-08-21	95%
md5_hash	`88602976f7c64499ef40e4972ac17db6`	payload	2026-08-21	95%
sha256_hash	`e89e2ea4c743c87ef7faff9303b9133c54737dd683536cf5e6518374fb130a4a`	payload	2026-08-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["729f56d9643c97fa9d9fb4a7696df881cbe0321b", "88602976f7c64499ef40e4972ac17db6", "e89e2ea4c743c87ef7faff9303b9133c54737dd683536cf5e6518374fb130a4a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Formbook IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate Phishing Simulation Campaigns
- Scenario: The security team uses platforms like KnowBe4 or Proofpoint Security Awareness to run simulated phishing campaigns. These simulations often include attachments (e.g., .docx with macros) that mimic the behavior of Formbook by establishing outbound connections to external validation servers, triggering the rule’s C2 communication logic.
- Filter/Exclusion: Create an exclusion based on the specific source IP ranges or domain names of the simulation vendor (e.g., *.knowbe4.com, *.proofpoint.com) and whitelist the specific file hashes associated with the campaign templates used in the last 30 days.
Scheduled Credential Backup Jobs via Microsoft Endpoint Manager
- Scenario: Enterprise IT administrators utilize Microsoft Intune or System Center Configuration Manager (SCCM) to run scheduled tasks that back up user credential stores and keystroke logs for compliance auditing. These jobs initiate outbound HTTPS connections to Azure Blob Storage or internal SQL servers, which the rule may misinterpret as Formbook’s data exfiltration pattern.
- Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., DOMAIN\IntuneBackupSvc) and filter out network destinations matching the organization’s internal backup storage CIDR blocks or Azure Storage endpoints (*.blob.core.windows.net).
Third-Party RMM Tool Agent Updates
- Scenario: Remote Monitoring and Management tools like Datto RMM, NinjaOne, or Lansweeper run background agents that periodically scan for security updates and sync configuration data. These agents often open covert communication channels to their cloud management consoles, mimicking the