ThreatFox: Vidar IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the specific network and file indicators of the Vidar malware to establish persistence and exfiltrate sensitive data within the Azure environment. Proactive hunting for these nine IOCs is critical to identify early-stage infections before they escalate into widespread lateral movement or data breaches, ensuring rapid containment in the Sentinel workspace.

IOC Summary

Malware Family: Vidar Total IOCs: 9 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["dup.omni-signage.com", "dup.kencangsm188.top", "cft.omni-signage.com", "cft.kencangsm188.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://dup.omni-signage.com/", "https://dup.kencangsm188.top/", "https://cft.omni-signage.com/", "https://cft.kencangsm188.top/", "https://vikingplaza.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Endpoint Detection and Response (EDR) Scheduled Scans

  • Scenario: The Vidar malware family often utilizes legitimate system utilities. In a corporate setting, scheduled full-system scans performed by tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne may trigger network connections to known Vidar IOCs (specifically if the EDR vendor has integrated ThreatFox feeds into their own reputation database). These scans generate high-volume traffic that mimics the initial beaconing behavior of Vidar.
  • Filter/Exclusion: Create an exclusion for processes originating from the specific EDR service executables (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) and restrict the alert to non-scan hours if possible, or whitelist the specific destination IP ranges associated with the EDR vendor’s update servers.

• Software Deployment via Configuration Management

  • Scenario: During routine patching cycles, Microsoft System Center Configuration Manager (SCCM) or Ansible agents deploy software updates that include components known to interact with Vidar-associated network endpoints. For instance, a scheduled job deploying the latest version of a third-party security agent or a browser update might initiate a connection to a Vidar IOC IP address used for license validation or telemetry during the installation phase.
  • Filter/Exclusion: Exclude traffic generated by known deployment service accounts (e.g., DOMAIN\SCCM-Deploy-Svc) and specific process paths related to configuration management tools (e.g., C:\Windows\CCM\CcmExec.exe or ansible-playbook). Additionally, whitelist the specific destination ports used for these administrative updates.