This hypothesis targets the presence of Vidar malware indicators, a remote access trojan frequently used by threat actors to establish persistent footholds and exfiltrate data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary leverages the RAT for lateral movement or further payload delivery.
Malware Family: Vidar Total IOCs: 15 IOC Types: ip:port, domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 167[.]233[.]139[.]3:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 5[.]9[.]73[.]173:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 46[.]29[.]26[.]67:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 2[.]28[.]34[.]186:443 | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://46[.]29[.]26[.]67/ | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://2[.]28[.]34[.]186/ | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://167[.]233[.]139[.]3/ | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://5[.]9[.]73[.]173/ | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://104[.]253[.]18[.]206 | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://welcome.v-panel.asia/ | botnet_cc | 2026-09-16 | 100% |
| domain | welcome.v-panel.asia | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://217[.]60[.]98[.]234 | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://84[.]200[.]125[.]134 | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://id.qq1x.org | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://ww.qq1x.org | botnet_cc | 2026-09-16 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["167.233.139.3", "46.29.26.67", "2.28.34.186", "5.9.73.173"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.233.139.3", "46.29.26.67", "2.28.34.186", "5.9.73.173"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["welcome.v-panel.asia"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://46.29.26.67/", "https://2.28.34.186/", "https://167.233.139.3/", "https://5.9.73.173/", "https://104.253.18.206", "https://welcome.v-panel.asia/", "https://217.60.98.234", "https://84.200.125.134", "https://id.qq1x.org", "https://ww.qq1x.org"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses Ansible or Terraform to deploy a new web application where the configuration files or database seeds contain the specific string patterns (e.g., vidar, vdr, or specific hash values) that match the Vidar IOCs.
ansible-playbook.exe, terraform.exe, or python.exe (if running from a known DevOps path) and the file path contains /deploy/, /config/, or /seeds/.Scenario: An IT administrator runs a Group Policy Object (GPO) update using gpupdate.exe or edits a .reg file via Registry Editor (regedit.exe) to push a new security policy that includes a registry key name or value data matching one of the Vidar IOCs (e.g., a specific GUID or string used in the policy).
gpupdate.exe, regedit.exe, or regsvr32.exe and the operation is a registry write (RegSetValue or RegCreateKey) targeting HKLM\Software\ or HKCU\Software\ paths associated with known enterprise software.Scenario: A SQL Server database administrator executes a BULK INSERT or OPENROWSET command to load a large CSV file into a staging table, where the CSV contains data fields (e.g., vendor names, product codes) that coincidentally match a Vidar IOC string (e.g., Vidar as a vendor name or vdr as a code).
sqlservr.exe or sqlcmd.exe and the file path ends with `.