ThreatFox: TELEPUZ IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of TELEPUZ malware by monitoring for specific indicators of compromise such as malicious file hashes and network connections. A SOC team should proactively hunt for these signals in Azure Sentinel to identify early-stage infections that leverage this banking trojan’s capabilities for credential theft and remote access, ensuring rapid containment before lateral movement occurs.

IOC Summary

Malware Family: TELEPUZ Total IOCs: 4 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TELEPUZ
let malicious_domains = dynamic(["krem.mesoptik.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - TELEPUZ
let malicious_urls = dynamic(["https://krem.mesoptik.com/v3/telemetry", "https://krem.mesoptik.com/v3/report", "https://krem.mesoptik.com/ws/stealer"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — TELEPUZ

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: TELEPUZ IOCs detection rule:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: The TELEPUZ malware often shares IOCs (specific file hashes or network destinations) with legitimate security vendors. In an environment using CrowdStrike Falcon or Microsoft Defender for Endpoint, the EDR agent may generate telemetry events that match the detection logic when scanning specific system folders or updating its own signature database.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\CrowdStrike\ and C:\ProgramData\Microsoft\Windows Defender\. Additionally, filter out network connections where the destination IP belongs to the vendor’s update cloud (e.g., CrowdStrike or Microsoft Azure ranges) rather than external unknown IPs.

• Scenario: Scheduled Backup Jobs via Veeam

  • Context: The detection logic flags specific file hashes that might coincide with backup artifacts generated by enterprise backup solutions like Veeam Backup & Replication. When a scheduled job runs during business hours, the backup service creates temporary files or connects to the repository server using IOCs that overlap with TELEPUZ signatures.
  • Filter/Exclusion: Create an exclusion rule for processes named vbr.exe (Veeam) and vssvc.exe running under the context of the “System” account. Filter out events where the parent process is a known backup service executable, specifically during the defined maintenance window (e.g., 02:00 – 04:00 daily).

• Scenario: Software Deployment via SCCM/Intune

  • Context: During mass software deployments using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, the deployment engine may download installer packages from internal distribution points.