ThreatFox: Vidar IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the Vidar infostealer to exfiltrate sensitive credentials and financial data through known indicators of compromise. Proactive hunting in Azure Sentinel is critical to identify early-stage infections across endpoints before lateral movement occurs, ensuring rapid containment of this high-severity threat vector.

IOC Summary

Malware Family: Vidar Total IOCs: 9 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["scp.psgiran.news", "scp.jangkarsm188.top", "tps.psgiran.news", "tps.jangkarsm188.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://scp.jangkarsm188.top/", "https://scp.psgiran.news/", "https://alpin-tuning.com/", "https://tps.psgiran.news/", "https://tps.jangkarsm188.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vidar IOCs rule in an enterprise environment, along with recommended filters and exclusions:

• Enterprise Antivirus Definition Updates

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) downloads a new definition package that includes a shared library component. This library shares a specific hash with one of the Vidar IOCs because it was recently added to a public threat intelligence feed used by multiple vendors.
  • Filter/Exclusion: Create an exclusion rule targeting processes under the C:\Program Files\ directory for known AV executables (e.g., FalconSensor.exe, MsMpEng.exe) that perform network connections or file writes matching the IOC hash, specifically excluding alerts where the parent process is the scheduled update service.

• IT Asset Management and Patch Deployment

  • Scenario: An automated patch management tool like Ivanti Neurons, SCCM (Microsoft Endpoint Configuration Manager), or Jamf Pro pushes a software deployment package to a fleet of workstations. The installer script extracts a temporary file containing a cryptographic signature or a shared DLL that matches the Vidar IOC, triggering an alert during the installation phase on user endpoints.
  • Filter/Exclusion: Exclude alerts where the process name is associated with known deployment tools (e.g., ccmexec.exe, JamfProAgent.exe) and the file path contains temporary directories like %TEMP% or specific deployment folders (C:\Windows\CCMCache). Additionally, filter by user context to exclude accounts ending in _svc or ADMIN$.

• Scheduled Backup and Data Archiving Jobs

  • Scenario: A nightly backup job utilizing Veeam Backup & Replication, Commvault, or **Rub