ThreatFox: SigLoader IOCs

Hunt Hypothesis

This hypothesis targets the presence of SigLoader, a versatile loader used by threat actors to establish initial access and deploy follow-on payloads, by matching against known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as SigLoader often operates stealthily to facilitate lateral movement and privilege escalation before traditional detections trigger.

IOC Summary

Malware Family: SigLoader Total IOCs: 48 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`4211f5d4d9264c88206fe09564fb41c5`	payload	2026-09-13	95%
md5_hash	`1f655924f90d0dd0e7a53d905f153221`	payload	2026-09-13	95%
sha256_hash	`f48cd2db9e47caf70aca8cd3465509365248586d319e2b09a12d4354743746de`	payload	2026-09-13	95%
sha1_hash	`992fb1ab364904d82f5aa3d601fd857e0428a9bd`	payload	2026-09-13	95%
md5_hash	`43f40c6b5f12c82e6017ddb3af33d3ac`	payload	2026-09-13	95%
sha256_hash	`5fe315609f09970c936310dea43318c2c5aca71da236c7f890c72e61f7696b5f`	payload	2026-09-13	95%
sha1_hash	`6ab4bd351777854559511fe92d93a45178407a73`	payload	2026-09-13	95%
md5_hash	`89e8142db77ae78017d70bee910bf37c`	payload	2026-09-13	95%
sha256_hash	`89c1bb04e296b0084b118a07f80316b5f694d7460ab13afc216c5bacc787d236`	payload	2026-09-13	95%
sha1_hash	`e662e5955b3f0b94fdf251283b553ccbaeb9c751`	payload	2026-09-13	95%
sha1_hash	`5771cc7002fdc049085fd20c63c7b81831682069`	payload	2026-09-13	95%
md5_hash	`7bcf228c5f9acc5fce436dd87d6cfff7`	payload	2026-09-13	95%
sha256_hash	`860fc154444167d8411d3796d047093ad242fcb071eb645e845ea9e048c15cb5`	payload	2026-09-13	95%
sha1_hash	`30e1a4b7b708f05c84bc1b454a662c8cdece1e2e`	payload	2026-09-13	95%
md5_hash	`c3a9a58d2cf4420197ebcf473a2006a2`	payload	2026-09-13	95%
sha256_hash	`603264cbf503d230902ee89324431bf3b81aebbdb31ca3cafe2deef0652405fc`	payload	2026-09-13	95%
sha256_hash	`eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893`	payload	2026-09-13	95%
sha1_hash	`c057e76cfc4ecd745116195def18236f94cce6c3`	payload	2026-09-13	95%
md5_hash	`ade728b0cb639b612376ca8938c8f997`	payload	2026-09-13	95%
sha256_hash	`52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815`	payload	2026-09-13	95%
sha1_hash	`d58953fab52eba0d293c5190cfdb2ad9a3c1839d`	payload	2026-09-13	95%
md5_hash	`be27e7f9638ffdb00fea6153fb7e5c87`	payload	2026-09-13	95%
sha1_hash	`3863ac083bec3be3372a3a5498aae2d6cecceec2`	payload	2026-09-13	95%
md5_hash	`a3c77141d07b9c01db06191a3fa0382b`	payload	2026-09-13	95%
sha256_hash	`56b6a194031b8403b7ff166187783d51acc7fe66cf930d9a0777ab1d9bb592c3`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SigLoader
let malicious_hashes = dynamic(["4211f5d4d9264c88206fe09564fb41c5", "1f655924f90d0dd0e7a53d905f153221", "f48cd2db9e47caf70aca8cd3465509365248586d319e2b09a12d4354743746de", "992fb1ab364904d82f5aa3d601fd857e0428a9bd", "43f40c6b5f12c82e6017ddb3af33d3ac", "5fe315609f09970c936310dea43318c2c5aca71da236c7f890c72e61f7696b5f", "6ab4bd351777854559511fe92d93a45178407a73", "89e8142db77ae78017d70bee910bf37c", "89c1bb04e296b0084b118a07f80316b5f694d7460ab13afc216c5bacc787d236", "e662e5955b3f0b94fdf251283b553ccbaeb9c751", "5771cc7002fdc049085fd20c63c7b81831682069", "7bcf228c5f9acc5fce436dd87d6cfff7", "860fc154444167d8411d3796d047093ad242fcb071eb645e845ea9e048c15cb5", "30e1a4b7b708f05c84bc1b454a662c8cdece1e2e", "c3a9a58d2cf4420197ebcf473a2006a2", "603264cbf503d230902ee89324431bf3b81aebbdb31ca3cafe2deef0652405fc", "eec6fb4f124564fea83670faf7b61140347020a3ca3eef052d4dc6bad4097893", "c057e76cfc4ecd745116195def18236f94cce6c3", "ade728b0cb639b612376ca8938c8f997", "52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815", "d58953fab52eba0d293c5190cfdb2ad9a3c1839d", "be27e7f9638ffdb00fea6153fb7e5c87", "3863ac083bec3be3372a3a5498aae2d6cecceec2", "a3c77141d07b9c01db06191a3fa0382b", "56b6a194031b8403b7ff166187783d51acc7fe66cf930d9a0777ab1d9bb592c3", "be5601d0a4dc2c2349135ddbced21846e7acf10d", "3661749e5775824005378ec713714326cb0070e9", "42418e61eb3496cfc66c15efb1a9ce42", "f1711b816466428b20ece9ebaa81ca377fd758771a33c959f46be582b1f4404d", "e203208abae204c1168a27fec04c5cf7ead97777855c36be04b8df35e1ad8df9", "d73d2bef75e819b60dc09de0ecbaaf40464c9597", "4461e5f60246a55d3388173bba071d81", "9460a12535d2aefed73c82a5b7fd7bcf0bb966610adeeda1e779d34348240440", "59a05e3ea01c1d732b50e1f8451facead4aaa11d", "1e6554b354c80d2206444e71567bc9b2", "5297d2a177b3f632ff3c8e81555beb56", "c64bc9489e1711e146a6705470f5065094853bc15840ea02f0f0e38fd2552b5d", "82bbc9eb600a2c9b13ca9cd19bb29158", "660f1a38bb5772fd54838a3d86d17fbe9b223f31f768eb1b1519e35f5f3f1684", "4eef38cda023ffa473d9aea01303fb99f45124ff", "d9debefbcf7a77436bb62a9af5dd19bd", "b7b4d20f7c9e6f568e5970da8b8fa558aa0462ba9a2065003b3d6c18b592176a", "d0142333a7af8c3829c1596ac9f5d836e9ae1971", "325d0d64493d61375858ff812d61575ab3d5f9ae", "3b5c7c2a47dc4be1bf7126251441d24b72774075", "b0fdb40d42afdc880bec986cd6544f3e", "d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6", "9741e24cffbf4549bf5f5d3aa20ee691c1bcb1b5fbe45274cee257b310c70257"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SigLoader

False Positive Guidance

Scenario: A DevOps team deploys a new internal build artifact or container image that shares a specific SHA-256 hash or file size with a known SigLoader payload, triggering the hash-based IOC.
- Filter/Exclusion: Exclude hashes for files located in verified internal artifact repositories (e.g., \\fileserver\artifacts\, C:\Program Files\InternalTools\) or add specific known-good SHA-256 hashes to the exclusion list if the artifact is confirmed benign.
Scenario: An administrator runs a legitimate third-party installer or update utility (e.g., Adobe Creative Cloud, Java, or .NET Framework) that writes temporary executables to %TEMP% or %APPDATA% with paths or names matching the SigLoader IOCs (e.g., svchost.exe in unusual directories or specific DLL names).
- Filter/Exclusion: Exclude processes or files where the parent process is a known signed installer (e.g., msiexec.exe, setup.exe from major vendors) and the file path resides in standard temporary or application data directories (%TEMP%, %LOCALAPPDATA%, %APPDATA%).
Scenario: A scheduled maintenance job or backup agent (e.g., Veeam, Commvault, or custom PowerShell scripts) creates temporary shadow copies or staging files that match the file size or naming conventions of SigLoader IOCs, particularly if the job runs under a service account.
- Filter/Exclusion: Exclude files created by known backup or maintenance service accounts (e.g., svc_backup, DOMAIN\svc_maintenance) or exclude paths within backup staging directories (e.g., C:\Backup\Staging\, D:\Veeam\).
Scenario: A developer or tester runs a local test harness or debug build of an application that