ThreatFox: Socks5Systemz IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the Socks5Systemz threat actor, which often utilizes proxy infrastructure for command and control or lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the adversary establishes deeper persistence within the network environment.

IOC Summary

Malware Family: Socks5Systemz Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Socks5Systemz
let malicious_ips = dynamic(["94.26.38.24", "64.89.160.142", "94.183.186.100"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.26.38.24", "64.89.160.142", "94.183.186.100"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Socks5Systemz

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Socks5Systemz IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Cloud Proxy Configuration by DevOps Team

  • Context: The DevOps team recently deployed a new containerized application using Socks5Systemz as an internal proxy for microservice communication. This involves the installation of the official Socks5Systemz binary on multiple Kubernetes nodes, triggering network connections to known IOCs (e.g., specific IP ranges or certificate hashes) associated with the vendor’s update servers.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (Socks5Systemz.exe or socks5-proxy) and restrict it to the Source Host Group “DevOps-K8s-Cluster”. Additionally, whitelist the specific destination IP addresses identified in the vendor’s documentation for update checks.

• Scenario: Scheduled Maintenance Job on Endpoint Management Servers

  • Context: The IT Operations team runs a nightly scheduled task (via Windows Task Scheduler) that updates endpoint security agents. This job invokes a script that communicates with Socks5Systemz management servers to pull policy definitions and license keys, generating traffic matching the rule’s IOCs during the maintenance window (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Implement a time-based exclusion for the detection logic. Configure the SIEM/SOAR platform to suppress alerts from this rule between 01:30 and 05:00 UTC when the source process is identified as TaskHost.exe or the specific maintenance script name (e.g., UpdatePolicyJob.ps1).

• Scenario: Third-Party Vendor Integration Testing

  • Context: A