ThreatFox: Satacom IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior characterized by network communications to known malicious indicators of compromise (IOCs) linked to the Satacom threat actor. Proactively hunting for these specific IOCs in Azure Sentinel is critical because their high severity rating suggests an active campaign that requires immediate identification and containment before lateral movement occurs.

IOC Summary

Malware Family: Satacom Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Satacom
let malicious_domains = dynamic(["eyuboglutv.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Satacom
let malicious_urls = dynamic(["https://eyuboglutv.com/nfront.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Satacom

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Satacom IOCs rule, tailored for a legitimate enterprise environment:

• Automated Vulnerability Scanning via Qualys or Tenable

  • Scenario: The enterprise’s vulnerability management platform (e.g., Qualys Cloud Agent) performs scheduled external asset discovery scans. During these scans, the scanner initiates HTTP/HTTPS connections to known Satacom IP ranges or domains to verify certificate validity and service availability, triggering a match on the rule’s IOCs.
  • Filter/Exclusion: Create an exclusion for source IPs belonging to the Qualys-Scanner or Tenable-Agent security groups. Alternatively, filter events where the destination port is restricted to standard web traffic (80/443) and the user agent string contains “Qualys” or “Tenable.”

• Scheduled Software Updates via Microsoft Endpoint Configuration Manager (MECM)

  • Scenario: A scheduled task runs nightly on Windows workstations to check for third-party application updates. If an enterprise application relies on Satacom services for license validation or update manifest retrieval, the WindowsUpdate service or a specific vendor updater process will generate outbound traffic matching the Satacom IOCs during the maintenance window (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Exclude events occurring between 01:00 and 05:00 local time where the process name matches UpdateOrchestrator.exe or SatacomUpdater.exe. Additionally, filter by user context to exclude accounts named SYSTEM or LocalService during these hours.

• Cloud Backup and Archiving Jobs (Veeam or Commvault)

  • Scenario: The organization utilizes a cloud backup solution that replicates data to an off