ThreatFox: Tofsee IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving four specific Indicators of Compromise (IOCs) linked to the Tofsee threat actor, which may signal reconnaissance or initial access attempts within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate affected assets and mitigate potential data exfiltration before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: Tofsee Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`102[.]220[.]160[.]58:420`	botnet_cc	2026-08-22	75%
ip:port	`102[.]220[.]160[.]58:418`	botnet_cc	2026-08-22	75%
ip:port	`102[.]220[.]160[.]58:427`	botnet_cc	2026-08-22	75%
ip:port	`102[.]220[.]160[.]58:421`	botnet_cc	2026-08-22	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Tofsee
let malicious_ips = dynamic(["102.220.160.58"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.58"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Tofsee

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: Tofsee IOCs detection rule, including specific triggers and recommended exclusions:

Scenario: Automated Vulnerability Scanning by Qualys or Tenable
- Context: Enterprise vulnerability scanners (e.g., Qualys Cloud Agent, Tenable Nessus) frequently probe internal hosts against known threat intelligence feeds. If the scanner’s signature database includes Tofsee indicators to test endpoint detection capabilities, it may trigger the rule during routine scans without actual malicious activity.
- Filter/Exclusion: Exclude network traffic and process executions originating from specific scanner service accounts (e.g., svc_qualys, tenable_agent) or filter by the known IP ranges of internal scanning appliances.
Scenario: Scheduled Endpoint Protection Updates via CrowdStrike or Microsoft Defender
- Context: During scheduled update cycles, EDR agents (such as CrowdStrike Falcon Sensor or Microsoft Defender for Endpoint) download and ingest new threat intelligence packages. If the “Tofsee” IOC package is part of a broader global feed ingestion job, the agent’s background service (C-Service.exe or MsMpEng.exe) may generate alerts while processing these signatures.
- Filter/Exclusion: Create an exclusion based on the parent process name (e.g., exclude events where ParentProcessName is falcon.sys or MsMpEng.exe) and restrict the rule to only trigger during non-maintenance windows (e.g., exclude 02:00–04:00 UTC).
Scenario: Security Information Management (SIEM) Ingestion Jobs
- Context: The organization’s SIEM platform (e.g., Splunk, Sentinel, or QRadar) runs nightly jobs to ingest external threat feeds. If the Tofsee IOC list is imported into the SIEM for