ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Vidar malware family within the Azure environment to establish persistence and exfiltrate sensitive data through its four key indicators of compromise. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly identify early-stage infections before they escalate into broader lateral movement or data theft incidents.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: md5_hash, sha1_hash, sha256_hash, url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://silverbackchatbot.com/`	payload_delivery	2026-07-14	75%
sha1_hash	`e256b2b7d0235138cea6b818f9bb44d7cfb5e4c8`	payload	2026-07-14	95%
md5_hash	`87700720a8a003a7d6e6da15958e4664`	payload	2026-07-14	95%
sha256_hash	`1105c195ea9bf21dcfc8882b1c3887d5056bece5b96170e0ad349cd82a3203a8`	payload	2026-07-14	95%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://silverbackchatbot.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Vidar
let malicious_hashes = dynamic(["e256b2b7d0235138cea6b818f9bb44d7cfb5e4c8", "87700720a8a003a7d6e6da15958e4664", "1105c195ea9bf21dcfc8882b1c3887d5056bece5b96170e0ad349cd82a3203a8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

Endpoint Protection Policy Updates via SCCM/MECM
- Scenario: The IT Operations team deploys a global policy update using Microsoft Endpoint Configuration Manager (MECM) to refresh the definition database for the organization’s EDR solution. This process triggers a background service (Antimalware Service Executable or similar) that downloads and executes the Vidar IOC package as part of a routine signature synchronization, generating network traffic matching the detection logic.
- Suggested Filter: Exclude traffic originating from known SCCM management servers (e.g., 10.x.x.x/24) where the destination port is 80/443 and the user agent string contains “Microsoft-ConfigurationManager” or the process name matches the EDR service executable path.
Scheduled Security Baseline Scans by Qualys
- Scenario: A nightly scheduled job runs on the Qualys Cloud Agent installed across all workstations to perform a vulnerability and compliance baseline scan. During this window, the agent queries external threat intelligence feeds (including ThreatFox) to cross-reference local file hashes against the Vidar IOC list, creating legitimate outbound connections that mimic active threat hunting behavior.
- Suggested Filter: Create an exclusion for processes named qualyspc.exe or qagent.exe running during business hours (e.g., 02:00–04:00 UTC) and restrict the rule to only alert on non-scheduled time windows or specific service accounts (e.g., svc_qualys_scan).
Software Deployment via Ansible Tower
- Scenario: The DevOps team executes an Ansible playbook to patch a fleet of file servers. As part of the