ThreatFox: Vidar IOCs

Hunt Hypothesis

This detection rule identifies active threats by monitoring network and endpoint telemetry for six specific Indicators of Compromise (IOCs) linked to the Vidar malware family, which is known for its modular architecture and data exfiltration capabilities. Proactive hunting in Azure Sentinel is critical because Vidar’s ability to evade traditional signature-based defenses requires continuous IOC validation to ensure early detection and rapid containment before sensitive data is compromised.

IOC Summary

Malware Family: Vidar Total IOCs: 6 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["ket.sm188daftar.mom", "ket.sm188dadu.top", "ket.1131gg.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://ket.sm188daftar.mom/", "https://ket.sm188dadu.top/", "https://ket.1131gg.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusion strategies for the ThreatFox: Vidar IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates via Windows Update Service

  • Context: The Vidar malware family often shares IOCs (specifically file hashes or network destinations) with legitimate security vendors. In many enterprise environments, the Windows Update service (usocsvc) or third-party agents like CrowdStrike Falcon or Microsoft Defender for Endpoint perform nightly definition updates that trigger connections to the same IP addresses or download files matching Vidar’s known signatures.
  • Suggested Filter/Exclusion: Create a process-based exclusion allowing svchost.exe (specifically the WindowsUpdate service) and C:\Program Files\CrowdStrike\fsqa.exe to bypass this rule when accessing IOCs associated with known security vendor domains (e.g., *.microsoft.com, *.crowdstrike.com).

• Scenario: Legitimate Software Deployment via SCCM/Intune

  • Context: During mass software deployments, the Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune often distributes application installers that contain embedded resources matching Vidar’s IOCs. For instance, a deployment of a new version of Adobe Acrobat Reader or Zoom might include a specific DLL hash or network beacon that overlaps with the Vidar detection logic, triggering alerts during the installation window (typically 02:00 – 04:00 UTC).
  • Suggested Filter/Exclusion: Implement a time-based and process-name exclusion. Exclude events where the parent process is ccmsetup.exe or IntuneAgent.exe occurring between 01:00 and 05:00 local time, specifically for file paths under `C:\Windows\CCMCache