ThreatFox: SnappyClient IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the SnappyClient tool by monitoring for specific Indicators of Compromise (IOCs) that signal potential reconnaissance or data exfiltration attempts. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage threats and mitigate risks associated with this client’s usage before they escalate into significant security incidents.

IOC Summary

Malware Family: SnappyClient Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SnappyClient
let malicious_hashes = dynamic(["e729ad151614c96d872320b40e2f2ad2", "5869e740ee9d36f62ee9e6e01b4deded4970043d6a6cdd792d0beb383b62c842", "4eec8596628db00cac1983789a55ee8c540a2ddd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SnappyClient

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SnappyClient IOCs detection rule, along with recommended filters and exclusions:

• Automated Endpoint Protection Updates via WSUS

  • Scenario: The enterprise utilizes Windows Server Update Services (WSUS) to push monthly security patches. During the scheduled update window, the SnappyClient service automatically downloads and installs new definition signatures or client updates from the vendor repository, triggering network connections and file creation events that match the rule’s IOCs.
  • Filter/Exclusion: Create an exclusion for traffic originating from the internal WSUS server IP range (e.g., 10.20.50.x) where the destination port is 443 or 80, and the process name matches SnappyClient.exe running under the SYSTEM account during business hours (09:00–17:00).

• Scheduled Group Policy Deployment of Configuration Profiles

  • Scenario: The IT Operations team deploys a new configuration profile via Group Policy Objects (GPO) every Tuesday at 02:00 AM. This triggers the SnappyClient agent to pull down a large XML configuration file and register it with the local database, generating IOCs related to file access and registry modification that mimic threat behavior.
  • Filter/Exclusion: Exclude events where the parent process is gpupdate.exe or svchost.exe (specifically the gpsvc service) and the event timestamp falls within the maintenance window of 01:30–04:00 UTC on Tuesdays.

• Third-Party Backup Agent Integration

  • Scenario: The organization uses Veeam Backup & Replication, which integrates with SnappyClient to perform real-time file indexing before a backup job starts.