ThreatFox: HypeAgent IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the HypeAgent threat, signaling potential reconnaissance or initial access attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical due to their high severity rating, enabling the SOC team to identify and contain early-stage threats before they escalate into broader incidents.

IOC Summary

Malware Family: HypeAgent Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["31.77.138.156", "80.76.49.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.77.138.156", "80.76.49.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — HypeAgent

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: HypeAgent IOCs detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Endpoint Protection Updates via SCCM

  • Context: The enterprise uses Microsoft Configuration Manager (SCCM) to push nightly updates. During these windows, the HypeAgent service often initiates a background scan or policy sync that triggers network connections matching the IOCs (e.g., specific SHA-256 hashes of update manifests).
  • Filter/Exclusion: Create an exclusion for traffic originating from the SCCM Distribution Point IP range (10.10.40.0/24) during the defined maintenance window (e.g., 02:00–04:00 UTC), specifically filtering out events where the ProcessName is ccmexec.exe or wuauserv.exe.

• Scenario: Automated Backup Jobs by Veeam

  • Context: The organization runs nightly backups using Veeam Backup & Replication. The backup agent on hypervisor hosts communicates with the HypeAgent management server to verify integrity, generating network flows that match the rule’s IOCs (specifically the HypeAgent communication port 8443).
  • Filter/Exclusion: Exclude alerts where the source process is identified as Veeam.Backup.Service.exe or vbrservice.exe, and the destination hostname contains keywords like “BackupServer” or “ReplicationNode”.

• Scenario: Admin-Initiated Health Checks via PowerShell

  • Context: System administrators frequently run custom PowerShell scripts (Invoke-HypeHealthCheck.ps1) to audit agent status across the fleet. These scripts often invoke the HypeAgent API directly, triggering the exact IOCs defined in the rule (such as specific