ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known Vidar malware indicators to identify active infections and potential lateral movement within the network. Proactively hunting these specific IOCs in Azure Sentinel is critical because Vidar’s modular architecture allows for rapid adaptation, making early detection essential to prevent data exfiltration before the threat evolves.

IOC Summary

Malware Family: Vidar Total IOCs: 11 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["her.psgiran.news", "her.jokimecat88.top", "sot.jokimecat88.top", "sot.psgiran.news"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://her.psgiran.news/", "https://her.jokimecat88.top/", "https://sot.psgiran.news/", "https://sot.jokimecat88.top/", "https://imperialroofingandgutteringltd.co.uk/", "https://jermainelewis.com/", "https://cyprushomestager.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, including suggested filters or exclusions:

• Endpoint Protection Scanning of Quarantine Folders

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs deep scans on the C:\ProgramData\ThreatFox\Quarantine directory. This folder contains archived IOC artifacts used for internal threat intelligence correlation, which include file hashes matching the Vidar IOCs (specifically known benign versions of the vidar.exe component).
  • Suggested Filter: Exclude alerts where the process path matches the EDR’s scanning service executable (e.g., C:\Program Files\CrowdStrike\csfalcon.exe) and the accessed file path contains \Quarantine\.

• Scheduled Threat Intelligence Feed Updates

  • Scenario: An automated scheduled task, managed via Windows Task Scheduler, runs nightly to ingest new threat intelligence feeds into the SIEM. The script (e.g., UpdateThreatIntel.ps1) downloads and validates a JSON payload containing the Vidar IOC list for signature updates. During this validation phase, the script generates temporary files that match the Vidar IOCs before they are ingested into the production database.
  • Suggested Filter: Create an exclusion rule for events originating from the SYSTEM account or specific service accounts (e.g., svc-threat-intel) where the parent process is a known PowerShell host (powershell.exe) executing scripts within the \Scripts\ThreatIntel\ directory during business hours (02:00 – 04:00 UTC).

• Software Deployment via Configuration Management

  • Scenario: The IT operations team uses **Ans