ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of Vidar malware indicators, a remote access trojan frequently used for credential theft and lateral movement, by correlating known IOCs against endpoint telemetry. Proactively hunting for these signatures allows the SOC to identify compromised assets before the adversary establishes persistent access or exfiltrates sensitive data within the Azure environment.

IOC Summary

Malware Family: Vidar Total IOCs: 3 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`ad821edb933557752728e1c68d3feb55258c99bb2c544e7a189c580ffe1bb546`	payload	2026-09-13	100%
sha256_hash	`0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e`	payload	2026-09-13	95%
sha256_hash	`510b4341c6763d5bf045973f4f9832cb8b66a414abda634d4fafed05cba03058`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["ad821edb933557752728e1c68d3feb55258c99bb2c544e7a189c580ffe1bb546", "0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e", "510b4341c6763d5bf045973f4f9832cb8b66a414abda634d4fafed05cba03058"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Scenario: A DevOps team uses a custom PowerShell script to automate the deployment of a legacy Java application, which includes a step to write configuration files to C:\Program Files\MyApp\config.xml and execute a verification binary named vidar_check.exe (a naming convention inherited from an old internal tool).
- Filter/Exclusion: Exclude alerts where the process path is under C:\Program Files\MyApp\ and the parent process is powershell.exe or pwsh.exe initiated by a service account (e.g., DOMAIN\svc-deploy).
Scenario: An IT administrator runs a scheduled task via Task Scheduler to clean up temporary files in user profiles, which inadvertently executes a cleanup script located in C:\Users\Public\vidar_cleanup.bat due to a historical naming error in the shared folder.
- Filter/Exclusion: Exclude alerts where the file path contains \Users\Public\ and the process name ends with _cleanup.bat or _clean.bat, provided the user context is a standard admin account (e.g., DOMAIN\adm-it) and the execution time aligns with the known scheduled task window.
Scenario: A security engineer performs a manual test of the endpoint detection platform by creating a benign test file named vidar_test.bin in the C:\Temp directory and executing it to verify alerting logic before a major release.
- Filter/Exclusion: Exclude alerts where the file path is C:\Temp\ and the filename matches vidar_test.*, provided the executing user is a member of the SecurityTeam AD group and the event occurs during business hours.
Scenario: A finance department uses a third-party reporting tool that bundles a helper executable named vidar_helper.dll (a misnamed dependency from the vendor) which is