ThreatFox: Vidar IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior consistent with the Vidar malware family by actively searching for its known indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these specific IOCs is critical to detect early-stage infections before they establish persistence or exfiltrate sensitive data, ensuring rapid containment in a high-severity threat scenario.

IOC Summary

Malware Family: Vidar Total IOCs: 4 IOC Types: ip:port, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]98[.]111[.]49:443`	botnet_cc	2026-07-11	100%
url	`hxxps://91[.]98[.]111[.]49/`	botnet_cc	2026-07-11	100%
url	`hxxps://ctkmarketplace.com/`	payload_delivery	2026-07-11	75%
url	`hxxps://integratepc.org/`	payload_delivery	2026-07-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["91.98.111.49"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.98.111.49"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://91.98.111.49/", "https://ctkmarketplace.com/", "https://integratepc.org/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Vidar

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Security Agent Updates and Definitions Sync
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled update of its threat intelligence feed. During this process, the agent downloads definition files that may contain hashes or network artifacts matching known Vidar indicators (e.g., specific DLL names or certificate issuers used in the malware’s legitimate components).
- Filter/Exclusion: Create an exclusion for processes running under the EDR service account (e.g., NT SERVICE\DefenderSvc or CrowdStrike Falcon Sensor) and restrict alerts to execution paths located within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).
IT Asset Management and Software Inventory Scans
- Scenario: A scheduled job using Microsoft SCCM (Configuration Manager) or Ivanti Neurons runs a software inventory scan across the domain. These tools often generate temporary files, scripts, or network connections to internal asset repositories that share file hashes or URL patterns with Vidar IOCs, particularly if the organization uses similar naming conventions for their internal deployment packages.
- Filter/Exclusion: Exclude alerts generated by known administrative service accounts (e.g., DOMAIN\SCCM_Service_Account) and filter out network traffic destined for internal IP ranges associated with the software distribution point servers.
Third-Party Antivirus Cloud Intelligence Queries
- Scenario: A legacy or secondary antivirus solution, such as Symantec Endpoint Protection (SEP) or Trend Micro, queries its cloud-based reputation service to verify file integrity. If the Vidar