ThreatFox: Formbook IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Formbook threat intelligence feed, signaling potential reconnaissance or initial access attempts by known malicious actors. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification of these high-severity signals enables the SOC team to rapidly isolate affected assets and mitigate threats before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: Formbook Total IOCs: 9 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`4c3c4e06e9994eded388727f5744c0746b76cb66f49efc0113111c7e6f975802`	payload	2026-08-25	95%
sha1_hash	`de348334e29485376b4e0f5487faf00184c51349`	payload	2026-08-25	95%
md5_hash	`e35bf4bd8ed78626b63cb917fb2fd576`	payload	2026-08-25	95%
sha256_hash	`6decd2481cdb54b64b432e5632bfc91fddb8bcaa7d0d2289366ee1ae895025b9`	payload	2026-08-25	95%
sha1_hash	`dcc8071900625e6e0df5de9ae0156c4da85b2c4b`	payload	2026-08-25	95%
md5_hash	`2e688af35698aadb14d24e425f5c5e8f`	payload	2026-08-25	95%
sha256_hash	`4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a`	payload	2026-08-25	95%
sha1_hash	`78c69adac0710e8ee3fa14f442fb1dce22ee4bb3`	payload	2026-08-25	95%
md5_hash	`bf1e808d7e6812bed9d86fd5aea256dd`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["4c3c4e06e9994eded388727f5744c0746b76cb66f49efc0113111c7e6f975802", "de348334e29485376b4e0f5487faf00184c51349", "e35bf4bd8ed78626b63cb917fb2fd576", "6decd2481cdb54b64b432e5632bfc91fddb8bcaa7d0d2289366ee1ae895025b9", "dcc8071900625e6e0df5de9ae0156c4da85b2c4b", "2e688af35698aadb14d24e425f5c5e8f", "4f9df700891ba8fcf918a8bcdd527d9109c7888be2201876fa64d73bfdcfd98a", "78c69adac0710e8ee3fa14f442fb1dce22ee4bb3", "bf1e808d7e6812bed9d86fd5aea256dd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: Formbook IOCs detection rule:

Scenario 1: Scheduled Backup Jobs by Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize external repositories or cloud storage providers. If the organization uses Formbook for document management, these backup agents may periodically poll Formbook’s API endpoints or download metadata files, triggering network connections to Formbook IOCs (IPs/Domains) that mimic active user sessions.
- Filter/Exclusion: Create a detection exclusion based on Process Name and User Account. Exclude alerts where the source process is VeeamAgent.exe, CommServe.exe, or vssvc.exe running under the specific service account (e.g., DOMAIN\BackupService) during defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario 2: Automated Document Ingestion via Power Automate Flows
- Context: IT and Operations teams frequently use Microsoft Power Automate to ingest documents from external portals into the Formbook repository. These cloud flows run as background tasks, initiating HTTP POST/GET requests to Formbook IOCs to upload or index files. Because these flows often run under a generic system identity rather than an interactive user, they can be flagged as suspicious automated traffic.
- Filter/Exclusion: Apply a filter on the Source User Identity. Exclude alerts where the UserAccount matches known service principal names (e.g., DOMAIN\PA-FormbookFlow) and the ProcessName is svchost.exe or msedge.exe (if running in headless mode) with a specific registry key indicating an automation context.