ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing Vidar malware to execute credential theft and sensitive data exfiltration following initial compromise through phishing vectors. Proactive hunting in Azure Sentinel is essential to identify early indicators of this sophisticated threat, enabling rapid containment before critical assets are accessed or extracted by the attacker.

IOC Summary

Malware Family: Vidar Total IOCs: 14 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["sii.11gokil.org", "zaf.11gokil.org", "ges.1001gacor.org", "tax.sm188dnsx.top", "sii.sm188dnsx.top", "zaf.sm188dnsx.top", "tax.11gokil.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://sii.11gokil.org/", "https://zaf.11gokil.org/", "https://tax.sm188dnsx.top/", "https://sii.sm188dnsx.top/", "https://zaf.sm188dnsx.top/", "https://tax.11gokil.org/", "https://ges.1001gacor.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

False Positive Scenarios for “ThreatFox: Vidar IOCs”

• Scenario 1: Legitimate Phishing Simulation Campaigns

  • Context: Security teams frequently conduct internal phishing simulations using platforms like KnowBe4, Proofpoint, or Covisec. These campaigns often distribute emails with attachments (e.g., PDF reports, Word documents) and links to training portals that may share hash signatures or domain patterns similar to Vidar’s initial delivery vectors.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the internal simulation server IP range (e.g., 10.20.x.x) or specific known simulation domains (e.g., *.knowbe4.com, *.proofpoint.com). Additionally, exclude alerts where the user agent string contains “PhishingSimulation” or matches a specific campaign ID header.

• Scenario 2: Scheduled Backup and Data Archiving Jobs

  • Context: Vidar is known for data exfiltration behavior. In an enterprise environment, scheduled backup agents such as Veeam, Rubrik, or Microsoft Azure Backup regularly connect to external cloud storage endpoints to upload large datasets. These connections often involve high-volume outbound traffic and credential usage that mimics the exfiltration profile of Vidar malware.
  • Filter/Exclusion: Implement a time-based exclusion for alerts occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) on specific backup service accounts (e.g., svc_backup_prod). Furthermore, exclude traffic destined for known cloud storage endpoints (e.g., blob.core.windows.net, s3.amazonaws.com) initiated by the backup agent process names (VeeamService.exe, AzureBackupAgent.exe).

• Scenario 3: Enterprise Document Management and Collaboration Tools *