ThreatFox: Vidar IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Vidar infostealer by monitoring network and endpoint logs for specific Indicators of Compromise (IOCs) known to be used in active campaigns. SOC teams should proactively hunt for these signals within Azure Sentinel to rapidly detect early-stage data exfiltration attempts and prevent broader credential theft incidents before they escalate.

IOC Summary

Malware Family: Vidar Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["rmv.123ful.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://rmv.123ful.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are the false positive scenarios and corresponding filters for the ThreatFox: Vidar IOCs detection rule:

• Scenario 1: Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Context: The enterprise uses Microsoft Defender for Endpoint (MDE) to push global policy updates. When MDE synchronizes its cloud-connected protection engine, it may download configuration files or threat intelligence feeds from Microsoft’s update servers that share IP addresses or file hashes with the Vidar malware family. This often triggers a match on the “Vidar” IOCs during routine morning sync windows.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name MsMpEng.exe (Microsoft Antimalware Service Executable) and restrict the detection to exclude traffic originating from Microsoft’s known update IP ranges (e.g., 13.107.x.x, 204.79.x.x).

• Scenario 2: Scheduled Third-Party Backup Jobs using Veeam or Commvault

  • Context: During nightly backup windows, the enterprise’s backup agents (such as Veeam Agent for Windows or Commvault Simpana) perform full scans of the file system. These agents often utilize generic network sockets and temporary staging files that mimic the communication patterns of Vidar’s command-and-control (C2) infrastructure. The detection logic may flag these high-volume, scheduled data transfers as suspicious Vidar IOCs.
  • Filter/Exclusion: Implement a time-based exclusion for the rule between 01:00 and 05:00 on weekdays, or add a specific process exclusion for VeeamAgent.exe and SimpanaDataAgent.exe.

• Scenario 3: Admin Deployment of Software via SCCM/Intune

  • Context: System Administrators frequently deploy