ThreatFox: Vidar IOCs

Hunt Hypothesis

This hypothesis detects adversary activity involving the Vidar infostealer by identifying specific indicators of compromise such as malicious file hashes and network connections. Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage data exfiltration attempts before they escalate into full-scale credential theft incidents.

IOC Summary

Malware Family: Vidar Total IOCs: 3 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["eos.123ful.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://eos.123ful.net/", "https://77.42.69.149"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

False Positive Scenarios for “ThreatFox: Vidar IOCs”

• Scenario: Legitimate deployment of the Vidar Malware Analysis Platform within the enterprise’s Security Operations Center (SOC) or R&D department.

  • Context: Internal security teams often run local instances of the Vidar platform to analyze new malware samples, which naturally generates network traffic and process executions matching the rule’s IOCs.
  • Filter/Exclusion: Create a filter to exclude traffic originating from the specific IP range of the SOC infrastructure (e.g., 10.50.20.0/24) or exclude processes where the parent executable is vidar_analyzer.exe running on designated analysis servers.

• Scenario: Scheduled automated backup jobs utilizing third-party tools that incorporate Vidar’s signature database.

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Acronis Cyber Protect may utilize Vidar’s detection engine for real-time scanning during nightly scheduled jobs, triggering the IOCs without indicating a threat.
  • Filter/Exclusion: Exclude events where the process name matches vbr.exe (Veeam) or acronis_agent.exe and the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Endpoint Detection and Response (EDR) agents performing routine signature updates.

  • Context: EDR platforms such as CrowdStrike Falcon or Microsoft Defender for Endpoint often download and process Vidar’s IOC feeds during their daily update cycles, causing the detection logic to fire on the update service itself.
  • Filter/Exclusion: Add an exclusion rule for processes named FalconSensorService.exe or MsMpEng.exe when the action