ThreatFox: Redosdru IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Redosdru malware by leveraging its specific Indicators of Compromise to establish persistence and exfiltrate sensitive data within the Azure environment. A proactive hunt is critical because early detection of these three high-severity IOCs in Azure Sentinel enables the SOC team to contain potential lateral movement before the threat escalates into a full-scale breach.

IOC Summary

Malware Family: Redosdru Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`0b5439d135dc4d685e3fa346ac56dc89713b1a86`	payload	2026-07-05	95%
md5_hash	`b2f641209efa51dda327fb48bafd0986`	payload	2026-07-05	95%
sha256_hash	`f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Redosdru
let malicious_hashes = dynamic(["0b5439d135dc4d685e3fa346ac56dc89713b1a86", "b2f641209efa51dda327fb48bafd0986", "f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Redosdru

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Redosdru IOCs detection rule, tailored for a legitimate enterprise environment:

Scheduled Antivirus Definition Updates via WSUS/SCCM
- Scenario: Enterprise endpoints or servers running scheduled updates (e.g., Windows Update Agent or Microsoft Endpoint Configuration Manager) download and execute definition files from the vendor’s repository. If Redosdru IOCs include specific hash values or URLs used by a major AV vendor (like CrowdStrike, SentinelOne, or Symantec), these routine update jobs will trigger alerts when they fetch new signatures.
- Filter/Exclusion: Create an exclusion for traffic originating from the internal WSUS server IP range or the specific process name wuauclt.exe / ccmexec.exe. Additionally, whitelist the known benign SHA-256 hashes of the AV vendor’s update executables if they match the IOC list.
Third-Party Patch Management Scans (e.g., Qualys or Tenable)
- Scenario: During a monthly vulnerability assessment cycle, agents like Qualys Cloud Agent or Tenable Nessus scan the network and download large asset inventory modules or plugin updates. If these tools utilize specific C2 domains or IP addresses that overlap with Redosdru’s known infrastructure (often common in shared cloud environments), the scanning activity will generate false positives on outbound connections.
- Filter/Exclusion: Exclude traffic where the source process is qualyspc.exe or tenable_agent.exe. Furthermore, add a filter to ignore alerts for destination IPs that are part of the organization’s approved “Patch Management Vendor” allow-list within the firewall policy.
IT Admin Remote Session and File Transfer
- Scenario: System administrators performing routine maintenance via tools like Microsoft SCCM, Ansible, or PowerShell remoting may download configuration