ThreatFox: SnappyClient IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the SnappyClient tool, which is frequently leveraged by threat actors for reconnaissance and lateral movement within cloud environments. Proactively hunting for these specific IOCs in Azure Sentinel enables the SOC team to identify early-stage intrusions before they escalate into broader incidents, ensuring rapid containment of potential threats associated with this client infrastructure.

IOC Summary

Malware Family: SnappyClient Total IOCs: 3 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - SnappyClient
let malicious_ips = dynamic(["89.208.103.186"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.208.103.186"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - SnappyClient
let malicious_domains = dynamic(["yoda-time.ink"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — SnappyClient

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SnappyClient IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Endpoint Protection Updates via Microsoft Intune

  • Context: The organization uses a scheduled task (SnappyClientUpdate) running every Tuesday at 02:00 AM to push security definitions. This process generates the specific IOCs (file hashes and network connections) associated with SnappyClient, triggering the rule despite being a known maintenance window activity.
  • Filter/Exclusion: Exclude alerts where the ProcessName is “SnappyClient.exe” AND the ParentProcessName is “Microsoft Intune Agent” OR “Task Scheduler”, restricted to the time window of 01:30–02:30 on Tuesdays.

• Scenario: Automated Patch Deployment by SCCM (System Center Configuration Manager)

  • Context: During a quarterly patch cycle, SCCM deploys SnappyClient updates to over 500 workstations simultaneously. The mass deployment triggers the IOCs across multiple endpoints within a short timeframe, causing an alert storm rather than a genuine threat signal.
  • Filter/Exclusion: Create a suppression rule that ignores alerts if the SourceIP belongs to the internal SCCM Management Point subnet (e.g., 10.20.5.0/24) and the event count exceeds 10 occurrences within a 5-minute window on the same host.

• Scenario: Legacy Application Integration in the Finance Department

  • Context: A custom financial reporting tool (“FinReport v4”) relies on a local SnappyClient service to encrypt data before transmission to the cloud warehouse. This service runs continuously during business hours, generating persistent IOCs that mimic active threat behavior.

  ---