ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Vidar malware family to exfiltrate sensitive data by matching network and endpoint telemetry against a curated set of twelve specific Indicators of Compromise (IOCs). Proactively hunting for these IOCs within Azure Sentinel is critical because Vidar’s modular architecture allows it to blend with legitimate traffic, making early detection essential to prevent persistent credential theft and lateral movement before the adversary establishes a foothold.

IOC Summary

Malware Family: Vidar Total IOCs: 12 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["46.225.5.205", "178.104.216.172", "2.28.53.94", "31.77.220.180", "46.225.104.177"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.225.5.205", "178.104.216.172", "2.28.53.94", "31.77.220.180", "46.225.104.177"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["hkd.sm188dvlv.lol", "gaz.sm188dvlv.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://178.104.216.172/", "https://46.225.5.205/", "https://hkd.sm188dvlv.lol/", "https://gaz.sm188dvlv.lol/", "https://2.28.53.94/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Vidar IOCs detection rule in an enterprise environment:

• Scenario: Automated Security Scanning by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform background telemetry collection. Their update services often connect to threat intelligence feeds that share the same IP ranges or hash signatures as the Vidar IOCs, triggering a match during routine health checks.
  • Suggested Filter: Create an exclusion based on the Process Name of the EDR agent (e.g., FalconSensor.exe, MsMpEng.exe) and exclude any network connections originating from these processes to the specific Vidar IP ranges, as they are known benign sources in this context.

• Scenario: Scheduled Software Deployment via Configuration Management Tools

  • Context: IT operations teams use tools like Microsoft SCCM (Configuration Manager) or Ansible to push software updates and patches during maintenance windows. These deployment agents often download installer packages from repositories that utilize the same domain names or file hashes identified in the Vidar IOC list, causing a hit when the “Download” event is logged.
  • Suggested Filter: Implement a time-based exclusion for the rule during known maintenance windows (e.g., 02:00–04:00 UTC) and add an exclusion for processes running under specific service accounts (e.g., NT SERVICE\CCMExec or Ansible-Worker) that match the Vidar IOCs.

• Scenario: Legitimate Cloud Backup and Synchronization Services

  • Context: Corporate data backup solutions such as Veeam Backup & Replication or Rubrik often synchronize metadata with cloud storage providers. If these services utilize