ThreatFox: HypeAgent IOCs

Hunt Hypothesis

This rule detects the initial infection and covert command-and-control establishment of the HypeAgent malware family by matching known threat intelligence indicators within Azure Sentinel logs. Proactive hunting for these specific IOCs is critical to identify early-stage compromises before adversaries can leverage their stealth capabilities to exfiltrate sensitive data or pivot laterally across the network.

IOC Summary

Malware Family: HypeAgent Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["94.154.32.73", "82.29.101.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.32.73", "82.29.101.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — HypeAgent

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: HypeAgent IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Enterprise Endpoint Protection Scheduled Scans

  • Context: The detection logic may flag the background scanning processes of major EDR solutions (e.g., Microsoft Defender Antivirus, CrowdStrike Falcon, or SentinelOne) when they perform scheduled full scans. These agents often establish covert command channels to fetch definition updates and report scan results, mimicking HypeAgent’s network behavior.
  • Suggested Filter/Exclusion: Exclude traffic originating from the specific service accounts used by your EDR agent (e.g., NT SERVICE\MsMpSvc for Defender or C:\Program Files\CrowdStrike\csagent.exe) where the destination is known update servers (e.g., *.microsoft.com, *.crowdstrike.com). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Automated Patch Management Deployments

  • Context: During monthly patch cycles, tools like Microsoft SCCM (Configuration Manager), WSUS, or Ivanti Neurons push updates to endpoints. These processes often spawn temporary agents that establish persistent command connections to the distribution point to verify installation status and download payloads, which can trigger the “covert command” signature of HypeAgent.
  • Suggested Filter/Exclusion: Create an exclusion for process execution paths associated with patch management tools (e.g., C:\Program Files\Microsoft Configuration Manager\ccmsetup.exe or C:\Ivanti\Application Management\agent.exe). Filter alerts where the parent process is a known system scheduler service (svchost.exe running under LocalSystem) during active deployment