ThreatFox: Latrodectus IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Latrodectus threat actor by monitoring for specific indicators of compromise across the Azure Sentinel environment. Proactively hunting these four IOCs is critical because Latrodectus represents a high-severity threat that requires early identification to mitigate potential data exfiltration or lateral movement before automated alerts trigger.

IOC Summary

Malware Family: Latrodectus Total IOCs: 4 IOC Types: sha256_hash, domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Latrodectus
let malicious_domains = dynamic(["bewsertinekk.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Latrodectus
let malicious_urls = dynamic(["https://2d4e5f6-7a8b-4c2d-9e1f-3b5a7c8d9e0fc.s3.us-east-1.amazonaws.com/config.cmd", "https://klonfcrtyseaflow.com/inline.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Latrodectus
let malicious_hashes = dynamic(["5BEA5AF5215089D97749D438351D7288310D0B8A472616EDBE1B34168AD1001C"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Latrodectus

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Latrodectus IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantined Archives

  • Scenario: The enterprise Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the “Quarantine” folder on file servers. This folder contains historical archives of known benign files that were previously flagged by other vendors but later cleared; these archives contain hash matches to Latrodectus IOCs from older threat intelligence feeds, triggering the rule despite no active infection.
  • Suggested Filter: Exclude alerts where the process path is a known EDR scanner (e.g., C:\Program Files\CrowdStrike\csagent.exe) and the file extension is .zip or .7z located within the specific “Quarantine” directory structure.

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team executes a scheduled deployment of a legacy application update using Microsoft Endpoint Configuration Manager (MECM) or Microsoft Intune. The installation package includes a third-party runtime library (e.g., an older version of a Java JRE or .NET framework) that shares a specific file hash with one of the Latrodectus IOCs. This triggers the detection during the mass rollout across 500+ workstations, even though the software is signed and trusted internally.
  • Suggested Filter: Create an exclusion for processes initiated by ccmexec.exe (SCCM) or IntuneManagementExtension.exe, specifically filtering out file paths under C:\Windows\CCMCache\* where the file hash matches the IOC but the digital signature is valid and issued by a trusted internal