ThreatFox: Vidar IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of malicious processes and network connections linked to the Vidar malware family, specifically leveraging eight known Indicators of Compromise (IOCs). Proactively hunting for these artifacts in Azure Sentinel is critical because Vidar’s modular architecture allows it to persist across diverse environments, making early detection essential to prevent data exfiltration before lateral movement occurs.

IOC Summary

Malware Family: Vidar Total IOCs: 8 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["vcf.psgiran.news", "vcf.jokimecat88.top", "vcd.psgiran.news", "framesavecloudjs.beer"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://vcf.psgiran.news/", "https://vcf.jokimecat88.top/", "https://vcd.psgiran.news/", "https://sollostech.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Vidar

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning & Quarantine Operations

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently download updated threat intelligence feeds containing Vidar indicators. During a scheduled scan, the EDR agent may generate network connections to these IOCs or create temporary files matching the hash signatures in the host’s quarantine folder before confirming them as benign.
  • Suggested Filter: Exclude processes originating from known security vendors (e.g., ProcessName contains “Cortex”, “SentinelOne”, or “MsMpEng”) and restrict alerts to specific file paths where EDR quarantines are stored (e.g., C:\ProgramData\Microsoft\Windows Defender\Quarantine).

• IT Asset Management & Patch Deployment

  • Scenario: System administrators using tools like Ivanti, ManageEngine Endpoint Central, or SCCM (System Center Configuration Manager) often deploy software updates that include security components. A scheduled job might install a new version of an antivirus module or a threat intelligence agent, triggering network traffic to Vidar IOCs during the initial configuration and registration phase.
  • Suggested Filter: Create an exclusion for specific service accounts used by deployment tools (e.g., User = “svc_patch_deploy” or “SYSTEM”) and correlate with the execution of known installer packages (e.g., ProcessName contains “msiexec.exe” or “Setup.exe” with a known Publisher).

• Security Information and Event Management (SIEM) Log Ingestion

  • Scenario: The organization’s SIEM platform, such as Splunk, **