ThreatFox: HijackLoader IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of HijackLoader malware components, which are known to hijack browser sessions and exfiltrate sensitive data through specific indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate compromised endpoints before lateral movement occurs, thereby mitigating the risk of credential theft and persistent access within the cloud environment.

IOC Summary

Malware Family: HijackLoader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - HijackLoader
let malicious_domains = dynamic(["iwannagetmoremoney.beer", "slippingpit61353.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — HijackLoader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: HijackLoader IOCs detection rule, tailored for an enterprise environment:

• Enterprise Endpoint Protection Updates

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads and executes a signature update package that includes a known hash or network artifact overlapping with the HijackLoader IOCs. This often occurs during scheduled maintenance windows where the agent communicates with the vendor’s cloud repository.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe) and restrict the rule to trigger only if the Parent Process is not a trusted system service. Alternatively, exclude specific SHA-256 hashes of the known update binaries from the IOC list.

• Third-Party Patch Management Deployments

  • Scenario: A scheduled job managed by patch management software (such as Ivanti Neurons, SCCM/MECM, or ManageEngine Endpoint Central) deploys a critical security patch to a batch of workstations. The deployment agent downloads the installer from an internal distribution point that mirrors the HijackLoader network indicators, triggering the rule during the installation phase.
  • Suggested Filter/Exclusion: Implement a filter based on User Context (e.g., NT AUTHORITY\SYSTEM or specific Service Accounts like svc-patch-deploy) and exclude events originating from known Internal IP Ranges associated with the patch management servers, rather than external internet traffic.

• IT Admin Script Execution via Scheduled Tasks

  • Scenario: An IT administrator runs a PowerShell script (e.g., Invoke-HijackScan.ps1 or a custom inventory collector) via Windows Task