ThreatFox: Phorpiex IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Phorpiex malware family, which is known for deploying information stealers and ransomware variants. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections before they escalate into data exfiltration or widespread network compromise.

IOC Summary

Malware Family: Phorpiex Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`e79d0d5d3076c47bc83cf4d60cd9e2471535f137`	payload	2026-08-25	95%
md5_hash	`5a081c877716d922366a17238c18bcbb`	payload	2026-08-25	95%
sha256_hash	`15e71f4e20634454a890c02d9494cc44b07e66cabea8d4bf3615dfde30d58e38`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Phorpiex
let malicious_hashes = dynamic(["e79d0d5d3076c47bc83cf4d60cd9e2471535f137", "5a081c877716d922366a17238c18bcbb", "15e71f4e20634454a890c02d9494cc44b07e66cabea8d4bf3615dfde30d58e38"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Phorpiex

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Phorpiex IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Software Updates via Microsoft Endpoint Manager (Intune)
- Context: The organization uses Intune to push a specific security tool update that bundles the Phorpiex installer. During scheduled maintenance windows, the installation service creates network connections and file writes matching the Phorpiex IOCs.
- Suggested Filter/Exclusion: Create an exclusion rule for processes running under the C:\Program Files\Microsoft Intune Management Extension\IntuneManagementExtension.exe parent process. Additionally, filter out alerts where the source IP belongs to the internal update server subnet (e.g., 10.x.x.x) during defined maintenance hours (e.g., 02:00–04:00 UTC).
Scenario: Scheduled Antivirus Definition Updates
- Context: The enterprise deploys a third-party EDR solution (e.g., CrowdStrike or SentinelOne) that utilizes Phorpiex as an underlying engine for heuristic scanning. A scheduled daily job triggers the download of new definition signatures, generating network traffic and file hashes identical to the threat IOCs.
- Suggested Filter/Exclusion: Exclude alerts where the initiating process is C:\Program Files\CrowdStrike\fs_qa.exe (or equivalent EDR agent path). Implement a time-based suppression for the specific “Definition Update” scheduled task ID, ensuring no alerts are generated between 03:00 and 05:00 local server time.
Scenario: Internal DevOps CI/CD Pipeline Execution
- Context: The development team runs automated build pipelines using Jenkins or Azure Dev Agents. These agents frequently download open-source