This hunt targets adversary behavior where Vidar malware establishes encrypted command-and-control channels to stealthily exfiltrate stolen credentials and sensitive data from endpoints. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat prevents lateral movement and mitigates the risk of widespread identity compromise before data leaves the network.
Malware Family: Vidar Total IOCs: 16 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://d11.kliksm188.top/ | botnet_cc | 2026-07-17 | 100% |
| url | hxxps://d11.ambiltogel.net/ | botnet_cc | 2026-07-17 | 100% |
| domain | d11.kliksm188.top | botnet_cc | 2026-07-17 | 100% |
| domain | d11.ambiltogel.net | botnet_cc | 2026-07-17 | 100% |
| url | hxxps://bfg.kliksm188.top/ | botnet_cc | 2026-07-17 | 100% |
| domain | bfg.kliksm188.top | botnet_cc | 2026-07-17 | 100% |
| domain | bfg.ambiltogel.net | botnet_cc | 2026-07-17 | 100% |
| url | hxxps://bfg.ambiltogel.net/ | botnet_cc | 2026-07-17 | 100% |
| url | hxxps://ffz.kliksm188.top/ | botnet_cc | 2026-07-16 | 75% |
| domain | ffz.kliksm188.top | botnet_cc | 2026-07-16 | 75% |
| url | hxxps://ffz.ambiltogel.net/ | botnet_cc | 2026-07-16 | 100% |
| domain | ffz.ambiltogel.net | botnet_cc | 2026-07-16 | 100% |
| domain | cra.kliksm188.top | botnet_cc | 2026-07-16 | 75% |
| url | hxxps://cra.kliksm188.top/ | botnet_cc | 2026-07-16 | 75% |
| url | hxxps://cra.ambiltogel.net/ | botnet_cc | 2026-07-16 | 100% |
| domain | cra.ambiltogel.net | botnet_cc | 2026-07-16 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["d11.kliksm188.top", "d11.ambiltogel.net", "bfg.kliksm188.top", "bfg.ambiltogel.net", "ffz.kliksm188.top", "ffz.ambiltogel.net", "cra.kliksm188.top", "cra.ambiltogel.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://d11.kliksm188.top/", "https://d11.ambiltogel.net/", "https://bfg.kliksm188.top/", "https://bfg.ambiltogel.net/", "https://ffz.kliksm188.top/", "https://ffz.ambiltogel.net/", "https://cra.kliksm188.top/", "https://cra.ambiltogel.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Enterprise Endpoint Protection Scans
C:\Program Files\Google\Chrome\Application directory. Vidar often targets browser profiles; if the EDR engine extracts or analyzes a legitimate Chrome update installer that shares a specific hash or file path signature with known Vidar IOCs, it may trigger the rule.svc-falcon or System) when accessing standard browser installation directories. Specifically, exclude alerts where the parent process is the EDR scanner and the file path matches known software vendor paths (e.g., \Google\, \Microsoft\Edge\).Software Deployment via SCCM/Intune
ccmexec.exe or IntuneManagementExtension) creates network connections to vendor update servers that match Vidar’s exfiltration patterns (e.g., TLS 1.2/1.3 on non-standard ports).ccmexec.exe, Microsoft.IntuneManagementExtension) and the destination IP belongs to the organization’s approved software vendor allow-list (e.g., Microsoft, Google, Cisco update servers).