ThreatFox: Formbook IOCs

Hunt Hypothesis

This hypothesis targets Formbook, a data-stealing malware that exfiltrates sensitive information like credentials and banking details while establishing persistence through stolen access. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, preventing the malware from leveraging persistence mechanisms to maintain a foothold and steal additional sensitive data.

IOC Summary

Malware Family: Formbook Total IOCs: 15 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`1b77d3f9e71c57cd5a3bf17f9fa4fbb051d1571d63c3223e3201f82ef7be9b14`	payload	2026-09-13	95%
sha1_hash	`d2476b5c451720dd76902b9e575f3b685d89cfc3`	payload	2026-09-13	95%
md5_hash	`5ad1b2748b02c7d9e65b4f990bdacb29`	payload	2026-09-13	95%
md5_hash	`9b8e765efa5ec8ec2929102723b3f754`	payload	2026-09-13	95%
md5_hash	`95f15b2bb39901645985addaf2b596b5`	payload	2026-09-13	95%
sha256_hash	`17ad3b76cf99eb60d1a47c70ffc1076c68a07ed7292253389b4ebc760bbce430`	payload	2026-09-13	95%
sha1_hash	`a0beb5d130c3f9e1b0ab6eb3c96d3af9afbd6eda`	payload	2026-09-13	95%
sha256_hash	`03115f6c0b387cc021c61632006b57859e65b25abc48923369d5caba71481544`	payload	2026-09-13	95%
sha1_hash	`558f4fc9f5f565f15242ba80d12d28067e3655c2`	payload	2026-09-13	95%
sha1_hash	`aefb2aeb4d9cf90d66785cd14d3f597c47969e12`	payload	2026-09-13	95%
md5_hash	`2f142ac7959a2abdd836de4d78cac59c`	payload	2026-09-13	95%
sha256_hash	`af44a80e5b05d59894b0970c46eea3b489f7e936e1e834531f1652a4eeb66fe5`	payload	2026-09-13	95%
sha1_hash	`e4f11c4bb4353382fcac5daef0c597e4f1f22cfa`	payload	2026-09-13	95%
md5_hash	`6ff26b74fc9ec8a190966a9caa97ae39`	payload	2026-09-13	95%
sha256_hash	`ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Formbook
let malicious_hashes = dynamic(["1b77d3f9e71c57cd5a3bf17f9fa4fbb051d1571d63c3223e3201f82ef7be9b14", "d2476b5c451720dd76902b9e575f3b685d89cfc3", "5ad1b2748b02c7d9e65b4f990bdacb29", "9b8e765efa5ec8ec2929102723b3f754", "95f15b2bb39901645985addaf2b596b5", "17ad3b76cf99eb60d1a47c70ffc1076c68a07ed7292253389b4ebc760bbce430", "a0beb5d130c3f9e1b0ab6eb3c96d3af9afbd6eda", "03115f6c0b387cc021c61632006b57859e65b25abc48923369d5caba71481544", "558f4fc9f5f565f15242ba80d12d28067e3655c2", "aefb2aeb4d9cf90d66785cd14d3f597c47969e12", "2f142ac7959a2abdd836de4d78cac59c", "af44a80e5b05d59894b0970c46eea3b489f7e936e1e834531f1652a4eeb66fe5", "e4f11c4bb4353382fcac5daef0c597e4f1f22cfa", "6ff26b74fc9ec8a190966a9caa97ae39", "ab456fcf30eea0dfadf5cde1ebe81dd692adbb0330660ab3d5eb9314bd292dd5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Formbook

False Positive Guidance

Scenario: Automated Web Scraping or SEO Auditing Tools
- Context: Tools like Screaming Frog, Selenium-based Python scripts, or Puppeteer are often used by marketing or QA teams to crawl websites, extract metadata, or test form submissions. These processes frequently involve rapid, sequential HTTP requests to various endpoints (including login pages or contact forms) and may use headless browsers that mimic user keystrokes or form interactions, potentially matching Formbook’s exfiltration patterns.
- Filter/Exclusion: Exclude processes where the parent process is a known browser automation framework (e.g., node.exe with puppeteer or chromedriver.exe) or where the user agent string contains “HeadlessChrome” or “Selenium”. Additionally, exclude network connections to internal staging environments or known SEO tool IP ranges.
Scenario: Enterprise Backup and Archiving Agents
- Context: Backup solutions like Veeam, Commvault, or Rubrik agents often read large volumes of file data (including credential stores, config files, and logs) and transmit them over the network to backup repositories. If the agent uses a generic service account or runs as a system process, its bulk data transfer and file access patterns can resemble Formbook’s data staging and exfiltration behavior, especially if it accesses sensitive directories like %APPDATA% or %LOCALAPPDATA% for configuration or state files.
- Filter/Exclusion: Exclude processes with known backup agent names (e.g., VeeamBackupSvc.exe, CommvaultAgent.exe) or services registered under backup-related names. Also, exclude network destinations that are internal backup servers or known cloud storage endpoints (e.g., *.aws.com, *.azure.com backup buckets) if the rule triggers on outbound traffic to these specific internal ranges.