ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Vidar infostealer by monitoring network and endpoint telemetry against a curated set of 27 known indicators of compromise. Proactive hunting for these IOCs within Azure Sentinel is critical to rapidly detect early-stage infections and prevent data exfiltration before attackers can establish persistence or escalate their operations.

IOC Summary

Malware Family: Vidar Total IOCs: 27 IOC Types: sha256_hash, url, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://46[.]29[.]26[.]35`	botnet_cc	2026-08-28	100%
url	`hxxps://nsn[.]12naga.org`	botnet_cc	2026-08-28	100%
url	`hxxps://185[.]229[.]225[.]31`	botnet_cc	2026-08-28	100%
sha256_hash	`a12e2897ab92927be491431c83e879cc83400e20cdd17f18c44e745354b0c175`	payload	2026-08-28	95%
sha1_hash	`6e1fc8c3b2fe30966191e52b90b1250a11f07a02`	payload	2026-08-28	95%
md5_hash	`8e522ecc5c43c7b3ddfe0fd389efbbc7`	payload	2026-08-28	95%
sha256_hash	`a8336d122352512323454e9fd24d9a7bcc096f793da23284a7301cbecda14a3b`	payload	2026-08-28	95%
sha1_hash	`17204bd9200bb6c98fb7432e3eab630e4b460c38`	payload	2026-08-28	95%
md5_hash	`817dccc481fd59fc79c76bb85fc77ae4`	payload	2026-08-28	95%
md5_hash	`8d06b638ca1acca4815076ae9fa3a4d0`	payload	2026-08-28	95%
sha1_hash	`48f8443f9e087064822a30c3e2f6ea6b4a57c490`	payload	2026-08-28	95%
md5_hash	`0d0bb2656a73610b2695fc8f3db21723`	payload	2026-08-28	95%
sha256_hash	`98fe10c077d59ab4a89dd551f76bba8ee220838f0c229498adb8471f50c65535`	payload	2026-08-28	95%
sha1_hash	`b9213ac9ac3f11c1dde4ea678fef6795e09886f7`	payload	2026-08-28	95%
sha256_hash	`712e7912a669a71a7006fd1a0333b5da45dbbc78672c46ae62e794fbc1372959`	payload	2026-08-28	95%
sha1_hash	`153d808ae3f57827a81024aa742ebbda96763f92`	payload	2026-08-28	95%
md5_hash	`133027a245bc3253038e082b5115a9dc`	payload	2026-08-28	95%
sha256_hash	`0c8c4a99337505f79c05af524ef2c8ce810269a1896b9bd83bbd39454a618b8d`	payload	2026-08-28	95%
md5_hash	`356484cecd7e391a8376ad70afa8f97a`	payload	2026-08-28	95%
sha256_hash	`16168cc3b16d768beffaf0fd10f74f86f79da7a2c7ca26edd91c09c1c101811d`	payload	2026-08-28	95%
sha1_hash	`eaf41de301f2e71c912836fd1eac285043ee841f`	payload	2026-08-28	95%
md5_hash	`9c61f3f9e04f32f1d66edbf131ba9a6b`	payload	2026-08-28	95%
sha1_hash	`8f1d05b224256caed347c500259b721ac97d70fc`	payload	2026-08-28	95%
md5_hash	`13f0f22fab59d7475a4ff3d926b1de63`	payload	2026-08-28	95%
sha256_hash	`97fdbb5506534af805db9e23503d93439322650eeaba8132c2627d8a1b9c2dfb`	payload	2026-08-28	95%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://46.29.26.35", "https://nsn.12naga.org", "https://185.229.225.31"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["a12e2897ab92927be491431c83e879cc83400e20cdd17f18c44e745354b0c175", "6e1fc8c3b2fe30966191e52b90b1250a11f07a02", "8e522ecc5c43c7b3ddfe0fd389efbbc7", "a8336d122352512323454e9fd24d9a7bcc096f793da23284a7301cbecda14a3b", "17204bd9200bb6c98fb7432e3eab630e4b460c38", "817dccc481fd59fc79c76bb85fc77ae4", "8d06b638ca1acca4815076ae9fa3a4d0", "48f8443f9e087064822a30c3e2f6ea6b4a57c490", "0d0bb2656a73610b2695fc8f3db21723", "98fe10c077d59ab4a89dd551f76bba8ee220838f0c229498adb8471f50c65535", "b9213ac9ac3f11c1dde4ea678fef6795e09886f7", "712e7912a669a71a7006fd1a0333b5da45dbbc78672c46ae62e794fbc1372959", "153d808ae3f57827a81024aa742ebbda96763f92", "133027a245bc3253038e082b5115a9dc", "0c8c4a99337505f79c05af524ef2c8ce810269a1896b9bd83bbd39454a618b8d", "356484cecd7e391a8376ad70afa8f97a", "16168cc3b16d768beffaf0fd10f74f86f79da7a2c7ca26edd91c09c1c101811d", "eaf41de301f2e71c912836fd1eac285043ee841f", "9c61f3f9e04f32f1d66edbf131ba9a6b", "8f1d05b224256caed347c500259b721ac97d70fc", "13f0f22fab59d7475a4ff3d926b1de63", "97fdbb5506534af805db9e23503d93439322650eeaba8132c2627d8a1b9c2dfb", "8376ef7e11d99d7b14e2b5d2750fc0978dcf4a8a", "4f8f926c45e51aa51bea9f95d3e8f34a29bcdc9dec1d3ea40354e50bb69c986b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Antivirus Definition Updates via Windows Defender
- Context: The Vidar malware often mimics legitimate system processes. In many enterprises, Windows Defender (or third-party AV like CrowdStrike) performs scheduled definition updates that involve downloading hash-matched files or executing scripts with similar network signatures to the Vidar IOCs. If the rule triggers on specific file hashes or network connections associated with these update services, it will generate noise during peak maintenance windows.
- Filter/Exclusion: Exclude processes where the ProcessName is MsMpEng.exe (Windows Defender) or C-Service.exe (CrowdStrike) and the ParentProcessName matches the AV service host. Additionally, add a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC daily).
Scenario: Deployment of Internal Configuration Management Scripts
- Context: IT Operations teams frequently use tools like Ansible, SCCM (Microsoft Endpoint Configuration Manager), or PowerShell DSC to push configuration changes. These tools often execute scripts that download, unzip, and run binaries from internal repositories. If the Vidar IOCs include specific file paths or network destinations used by these internal repositories, legitimate deployment jobs will trigger the rule.
- Filter/Exclusion: Create an exclusion for ProcessName containing ccmexec.exe (SCCM) or ansible-playbook, and filter out events where the SourceIP belongs to the internal management subnet (e.g., 10.20.x.x). Ensure the rule ignores traffic originating from known deployment servers identified in the CMDB.
**Scenario