ThreatFox: Gentlemen IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Gentlemen threat actor by monitoring for eight specific Indicators of Compromise (IOCs) known to signal their presence within the environment. Proactively hunting for these signatures in Azure Sentinel is critical because early identification allows the SOC team to rapidly contain potential intrusions before they escalate into significant data breaches or lateral movement campaigns.

IOC Summary

Malware Family: Gentlemen Total IOCs: 8 IOC Types: md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Gentlemen
let malicious_hashes = dynamic(["5f319c7e83b8daa6836b8ae674c8e0e6", "6add66a89721e2b7d817ba0d0f0d660e", "55adc1b1cd21895765d8aff36d894382", "15ced19102f80a843c22480e362c8811", "50d6a53992cb7d6eb09bc71294e5a68f", "71f152d84b2928c6163724de1cb6fae3", "4a9837dd830f8db27380836ef3a6adec", "f3c6ca1ba97b7f94ab52584dc62ea691"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Gentlemen

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Gentlemen IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Updates via Central Management Console

  • Scenario: The central management server (e.g., Microsoft Endpoint Configuration Manager or CrowdStrike Falcon) pushes a scheduled definition update to workstations. This process triggers the Gentlemen IOCs because the vendor’s signature database includes known benign hashes from the Gentlemen campaign that are also present in standard security tool configurations.
  • Filter/Exclusion: Exclude traffic and file executions originating from the specific management server IP range (e.g., 10.20.50.x) or whitelist the hash of the update agent executable (UpdateAgent.exe) running under the SYSTEM account during business hours.

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: IT administrators deploy a critical patch for a line-of-business application (e.g., Adobe Acrobat Reader or Java Runtime) using System Center Configuration Manager (SCCM). The deployment package contains installer scripts that match the Gentlemen IOC patterns, specifically regarding network connections to update servers and file creation in temporary directories.
  • Filter/Exclusion: Create an exclusion rule for processes launched by the ccmexec.exe service or specific SCCM task sequences (TaskSequenceID: TS-2023-GENT). Additionally, filter out events where the parent process is identified as a known deployment orchestrator tool.

• Scheduled Backup and Archiving Jobs

  • Scenario: A nightly backup job (e.g., using Veeam Backup & Replication or Commvault) archives user home directories to an on-premise storage array. The archiver reads and writes large volumes of data, generating network flows and file access events that align with the Gentlemen IOCs, particularly regarding DNS queries to internal repository