ThreatFox: Formbook IOCs

Hunt Hypothesis

Formbook is a data-stealing malware that exfiltrates sensitive information such as credentials, making it a critical threat to detect early in the environment. Proactively hunting for its IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints and prevent the loss of critical assets before the adversary achieves their objective.

IOC Summary

Malware Family: Formbook Total IOCs: 24 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	85f96d3803a17f8bda15b193eb55d3ddcd1f0390	payload	2026-09-05	95%
md5_hash	1e8443bbc17a0f0dca956dbdd9d3d274	payload	2026-09-05	95%
sha1_hash	27946451f00afd4b9bf6e285056dcaea9161cbd4	payload	2026-09-05	95%
md5_hash	3b282e4ddebcf205e87806c698566ee1	payload	2026-09-05	95%
sha256_hash	77a8fe21f54a964ccabd5567514aca90f5ab1b4f4c8def0d109d09cf9a969ac8	payload	2026-09-05	95%
sha256_hash	a33933b7d1b91190ee240484b5892f58159a9c3b70438ce8b41e42cde07ca02b	payload	2026-09-05	95%
sha256_hash	10344c6e5ccd5c6d77b8c41c9b3c1b8df224add85659770ada88f6d0f6404334	payload	2026-09-05	95%
sha1_hash	9c8e8a1d56ea2e1928cc3c3d26567baf0860d330	payload	2026-09-05	95%
md5_hash	47aabf6ff91aa305e54be7820a574222	payload	2026-09-05	95%
sha256_hash	87843d4d75d858a1802d545a80afbdf986d5aa3a30588c5094864f55d1ca8f53	payload	2026-09-05	95%
sha1_hash	90bd53ec52e54d11e86829fc6e76408e0339051d	payload	2026-09-05	95%
md5_hash	df6eebe6085a7091f5e9e0508f2a2b25	payload	2026-09-05	95%
md5_hash	f4a01dfda391b0903a8d6807f49a9d72	payload	2026-09-05	95%
sha256_hash	dc8c2b939621066c6bc97a82b496a41b7b79cfc6e703e0c3a78c3ba7bbe0470e	payload	2026-09-05	95%
sha1_hash	b3afefdc7f9583006c9fa8d9b87cd9423228703f	payload	2026-09-05	95%
sha1_hash	98b87e352f0aa578eae0c6c4aacacaf5032fa019	payload	2026-09-05	95%
md5_hash	b91ce67cd66d3a3e33f4b972742ef46b	payload	2026-09-05	95%
sha256_hash	d54f59c6edb9498cfce54ed5702561c0fb531a6c28991c17de9fa3e6bb98d7ca	payload	2026-09-05	95%
sha1_hash	749db9e4ac24363637eca659983601f1819516a0	payload	2026-09-05	95%
md5_hash	28ff73b8a7e61a809ee01abae32578af	payload	2026-09-05	95%
sha256_hash	6951b6c8eaad2ba11fb84f2c34008f4dda63be5f9a9dab4ae5d6cff50d8266a3	payload	2026-09-05	95%
md5_hash	e05fbd283c8ee39438fe1fb51c594015	payload	2026-09-05	95%
sha1_hash	293a9e19154301900dd1d43b9ba5cf789101f830	payload	2026-09-05	95%
md5_hash	9a5ea70bc0ca5362aacaa0db8564e415	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["85f96d3803a17f8bda15b193eb55d3ddcd1f0390", "1e8443bbc17a0f0dca956dbdd9d3d274", "27946451f00afd4b9bf6e285056dcaea9161cbd4", "3b282e4ddebcf205e87806c698566ee1", "77a8fe21f54a964ccabd5567514aca90f5ab1b4f4c8def0d109d09cf9a969ac8", "a33933b7d1b91190ee240484b5892f58159a9c3b70438ce8b41e42cde07ca02b", "10344c6e5ccd5c6d77b8c41c9b3c1b8df224add85659770ada88f6d0f6404334", "9c8e8a1d56ea2e1928cc3c3d26567baf0860d330", "47aabf6ff91aa305e54be7820a574222", "87843d4d75d858a1802d545a80afbdf986d5aa3a30588c5094864f55d1ca8f53", "90bd53ec52e54d11e86829fc6e76408e0339051d", "df6eebe6085a7091f5e9e0508f2a2b25", "f4a01dfda391b0903a8d6807f49a9d72", "dc8c2b939621066c6bc97a82b496a41b7b79cfc6e703e0c3a78c3ba7bbe0470e", "b3afefdc7f9583006c9fa8d9b87cd9423228703f", "98b87e352f0aa578eae0c6c4aacacaf5032fa019", "b91ce67cd66d3a3e33f4b972742ef46b", "d54f59c6edb9498cfce54ed5702561c0fb531a6c28991c17de9fa3e6bb98d7ca", "749db9e4ac24363637eca659983601f1819516a0", "28ff73b8a7e61a809ee01abae32578af", "6951b6c8eaad2ba11fb84f2c34008f4dda63be5f9a9dab4ae5d6cff50d8266a3", "e05fbd283c8ee39438fe1fb51c594015", "293a9e19154301900dd1d43b9ba5cf789101f830", "9a5ea70bc0ca5362aacaa0db8564e415"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Formbook

False Positive Guidance

• Scenario: A DevOps engineer uses WinSCP or FileZilla to manually transfer large log archives or build artifacts from a jump host to an external staging server for CI/CD pipeline verification.
  • Filter/Exclusion: Exclude processes where the parent is a known GUI file transfer client (e.g., winscp.exe, filezilla.exe) and the destination IP is within the documented staging subnet range, provided the source file extension is not an executable (.exe, .dll, .bin).
• Scenario: An IT administrator runs a scheduled PowerShell script to back up user profile data or application state to a NAS device using robocopy or rsync over SMB, which may trigger network exfiltration heuristics if the rule monitors high-volume outbound data transfers from user contexts.
  • Filter/Exclusion: Exclude network connections initiated by svchost.exe or powershell.exe where the destination is a known internal NAS IP range (e.g., 10.20.0.0/24) and the service name is SMB or CIFS, specifically when the user account belongs to the BackupAdmins security group.
• Scenario: A security team performs a periodic vulnerability scan using Nessus or Qualys agents that temporarily download plugin updates or upload scan results to the cloud console, potentially mimicking Formbook’s data exfiltration behavior via HTTPS.
  • Filter/Exclusion: Exclude outbound HTTPS connections to known vendor domains (e.g., *.nessus.org, *.qualys.com) initiated by the scanner service process (e.g., nessus.exe, qagent.exe) when the user context is a service account (e.g., svc_nessus) rather than an interactive user.
• Scenario: A finance department