ThreatFox: SnappyClient IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with the SnappyClient malware, a tool frequently used by adversaries for initial access and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially preventing the execution of malicious payloads or the establishment of persistent footholds within the environment.

IOC Summary

Malware Family: SnappyClient Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`5d43f472743ec596067f96a143e0058a8bd27b119f59e2705293334c21fd05f4`	payload	2026-09-13	95%
sha1_hash	`ca0114a1d5d941287431fd5f506b85df0b1d4a62`	payload	2026-09-13	95%
md5_hash	`72b4cbacd5e0f967cda3a9adfd04a136`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SnappyClient
let malicious_hashes = dynamic(["5d43f472743ec596067f96a143e0058a8bd27b119f59e2705293334c21fd05f4", "ca0114a1d5d941287431fd5f506b85df0b1d4a62", "72b4cbacd5e0f967cda3a9adfd04a136"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SnappyClient

False Positive Guidance

Scenario: A DevOps team deploys a custom internal build artifact or container image named snappy-client (or similar) for a specific microservice, and the file hash or path matches one of the SnappyClient IOCs.
- Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalApps\SnappyService\) or exclude hashes associated with known internal build pipelines (e.g., Azure DevOps or Jenkins artifact IDs).
Scenario: An IT administrator uses a legitimate third-party utility or script named snappy_client.py or snappy-client.exe for data compression or backup tasks, which is executed from a standard admin workstation or jump server.
- Filter/Exclusion: Exclude execution from specific administrative user groups (e.g., Domain Admins, IT_Ops) or exclude paths under common admin tool directories (e.g., C:\Tools\, C:\Admin\).
Scenario: A scheduled task or service on a web server or application server runs a dependency or helper binary related to a legitimate “Snappy” compression library (e.g., libsnappy.so or snappy.dll) that shares a similar name or hash with the malicious SnappyClient IOC.
- Filter/Exclusion: Exclude files with extensions typical of libraries (.dll, .so, .pyd) or exclude execution from standard system/application library paths (e.g., C:\Windows\System32\, /usr/lib/, node_modules/).
Scenario: A security team or blue team conducts a red team exercise or threat hunting simulation using a copy of the SnappyClient sample or a similar IOC to test detection coverage, triggering the rule on multiple hosts.
- Filter/Exclusion: Exclude hosts tagged with a specific AD