ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Vidar malware by matching network and host telemetry against a curated set of 14 known indicators of compromise (IOCs). Proactive hunting for these IOCs within Azure Sentinel is critical to identify early-stage infections that may evade standard signature-based detections, allowing the SOC team to rapidly isolate affected systems before lateral movement occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 14 IOC Types: sha1_hash, url, sha256_hash, md5_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://chi.12naga.org", "https://ley.123ful.net"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["a1bde6f032dc7452a8e447e9750a3b14a1e5c7e3803420e8919831fe67b338b7", "3dd25cbfe76db155615283f905992030468f3da9", "fb472c15a793251aeeb03b38bd4a678f", "8bbbf6e8040d137c142bbf1775be770c", "db4a45d88c943be3f60bf216bb6ac8a2d3b70dfa13e9669e402f11e2aaea1b74", "0d5f36f78a1cbf922f9e33c348c5693e93e24c06", "0f1af10b96c08c9aeecf28c2fa238542e667d218df65ce51701aaaeb7dcc75b1", "94c1d86395777db22933c0d97cac2b535d543c87", "0b130d9fec6bb8f9b80b13e110d4e0b0", "117dc9528d518447ab50ba8114b5a47fd06a7c251ade9e90162df66fcb7fd279", "b38e013a2139f76614c42147befaa2d357ab56ec", "7399b202c9c2fe7479680505e1f55e89"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule, along with targeted filtering strategies:

• Scenario: Automated Endpoint Protection Updates

  • Context: The enterprise uses CrowdStrike Falcon or Microsoft Defender for Endpoint. During scheduled update cycles (e.g., every Tuesday at 02:00 AM), the EDR agent downloads definition updates from a known vendor repository that shares an IP address or domain hash with one of the Vidar IOCs.
  • Filter/Exclusion: Create a rule exception based on the Process Name (e.g., FalconSensor.exe or MsMpEng.exe) and restrict the alert to only trigger if the parent process is NOT a known EDR service. Alternatively, exclude traffic originating from the specific internal update server IP range used by the security vendor.

• Scenario: Scheduled Backup Jobs via Cloud Storage

  • Context: A nightly backup job managed by Veeam Backup & Replication or Rubrik connects to an external cloud storage bucket (e.g., AWS S3 or Azure Blob) for offsite archiving. The connection involves a DNS lookup or HTTP request that matches a Vidar domain IOC used by the malware’s command-and-control infrastructure.
  • Filter/Exclusion: Implement a filter excluding alerts where the Source Process is vbr.exe (Veeam) or rubrik-agent.exe, and the destination URL contains specific backup-related keywords (e.g., /backup, /archive). Additionally, exclude traffic occurring strictly within the defined maintenance window (e.g., 01:00–04:00).

• Scenario: Third-Party Patch Management Deployment

  • Context: The IT team utilizes Ivanti Neurons or BigFix to