ThreatFox: GUIDLOADER IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs linked to the GUIDLOADER malware, which adversaries use to establish persistence or execute payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to identify compromised assets early, potentially preventing lateral movement or data exfiltration before the threat actor achieves their operational objectives.

IOC Summary

Malware Family: GUIDLOADER Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`fef80540b2bb3bacde65d425912531a8`	payload	2026-09-05	95%
sha1_hash	`5d5bcc3466fce6d64aed62d72ffce37078cc698f`	payload	2026-09-05	95%
md5_hash	`c4efe7eba55e16547cfd29eb349c8545`	payload	2026-09-05	95%
sha256_hash	`fbc7ba2c26bae1175976f140bb9d4d5eaf744c95ba8aaadec3fd8ad129b89221`	payload	2026-09-05	95%
sha1_hash	`40fb0535b5057ba61b62b352366d8fe331d427ce`	payload	2026-09-05	95%
sha256_hash	`7fbbeb23e339797e7165db5463c8278c4507900e0f37781a2f3d4152ad73ae93`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GUIDLOADER
let malicious_hashes = dynamic(["fef80540b2bb3bacde65d425912531a8", "5d5bcc3466fce6d64aed62d72ffce37078cc698f", "c4efe7eba55e16547cfd29eb349c8545", "fbc7ba2c26bae1175976f140bb9d4d5eaf744c95ba8aaadec3fd8ad129b89221", "40fb0535b5057ba61b62b352366d8fe331d427ce", "7fbbeb23e339797e7165db5463c8278c4507900e0f37781a2f3d4152ad73ae93"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GUIDLOADER

False Positive Guidance

Legitimate GUID-based Task Creation by Admin Tools: System administrators using PowerShell (Register-ScheduledTask) or schtasks.exe to create scheduled tasks often generate unique GUIDs for task identifiers. If the IOC list includes generic or recently observed GUIDs that match standard Windows task GUIDs or specific enterprise automation scripts (e.g., SCCM client updates, Intune remediation scripts), this can trigger false positives.
- Filter/Exclusion: Exclude alerts where the process creating the GUID is a known administrative tool (e.g., powershell.exe, schtasks.exe, taskeng.exe) and the parent process is a trusted admin utility (e.g., conhost.exe launched by an admin, or ccmexec.exe for SCCM).
Intune/MDM Policy Deployment GUIDs: Enterprise MDM solutions like Microsoft Intune or SCCM use GUIDs to identify policy definitions, compliance rules, or application deployments. If the GUIDLOADER IOCs include GUIDs that overlap with common Intune policy IDs or SCCM package IDs, legitimate policy pushes to endpoints will trigger the rule.
- Filter/Exclusion: Exclude alerts where the GUID is associated with processes known to handle MDM/MDT tasks (e.g., MdmClient.exe, ccmexec.exe, IntuneAgent.exe) or where the file path resides in standard MDM directories (e.g., C:\Program Files (x86)\Microsoft Intune\, C:\Program Files (x86)\Microsoft Configuration Manager\).
Browser Extension or Plugin GUIDs: Modern browsers (Chrome, Edge, Firefox) and enterprise plugins (e.g., Adobe Acrobat, Java, .NET assemblies) use GUIDs to identify extensions, components, or COM objects. If the IOC list includes GUIDs that correspond to widely deployed enterprise browser extensions or legacy COM components (