This hunt targets adversary behavior consistent with the Vidar malware family by actively searching for network and host artifacts matching its specific set of 15 Indicators of Compromise (IOCs). Proactive hunting is essential in Azure Sentinel to identify early-stage infections or lateral movement before automated alerts trigger, ensuring rapid containment of this high-severity threat.
Malware Family: Vidar Total IOCs: 15 IOC Types: url, ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://bar.omni-signage.com/ | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://bar.kataksm188.top/ | botnet_cc | 2026-07-09 | 100% |
| domain | bar.omni-signage.com | botnet_cc | 2026-07-09 | 100% |
| domain | bar.kataksm188.top | botnet_cc | 2026-07-09 | 100% |
| ip:port | 116[.]202[.]6[.]223:443 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 46[.]224[.]169[.]55:443 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 172[.]235[.]191[.]111:443 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 88[.]99[.]120[.]224:443 | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://172[.]235[.]191[.]111/ | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://116[.]202[.]6[.]223/ | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://46[.]224[.]169[.]55/ | botnet_cc | 2026-07-09 | 100% |
| domain | ned.omni-signage.com | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://ned.omni-signage.com/ | botnet_cc | 2026-07-09 | 100% |
| domain | ned.kataksm188.top | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://ned.kataksm188.top/ | botnet_cc | 2026-07-09 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vidar
let malicious_ips = dynamic(["116.202.6.223", "88.99.120.224", "46.224.169.55", "172.235.191.111"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["116.202.6.223", "88.99.120.224", "46.224.169.55", "172.235.191.111"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Vidar
let malicious_domains = dynamic(["bar.omni-signage.com", "bar.kataksm188.top", "ned.omni-signage.com", "ned.kataksm188.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Vidar
let malicious_urls = dynamic(["https://bar.omni-signage.com/", "https://bar.kataksm188.top/", "https://172.235.191.111/", "https://116.202.6.223/", "https://46.224.169.55/", "https://ned.omni-signage.com/", "https://ned.kataksm188.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Vidar IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Internal Security Scanner Traffic: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft Defender Vulnerability Management) often perform scheduled scans against the entire network range. These tools may generate HTTP requests to known Vidar IOCs (such as update servers or command-and-control domains) while probing for open ports and service banners, mimicking lateral movement.
Software Deployment and Patch Management: Automated deployment tools like Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf frequently push updates to endpoint agents. If the Vidar IOCs include domains related to software distribution networks or update repositories, these scheduled jobs will trigger connections from thousands of endpoints simultaneously as they download and install patches.
ccmexec.exe, JamfAgent.exe) connecting to the specific Vidar IOCs, or whitelist the destination IP addresses if they are part of a trusted software supply chain.Web Proxy and Content Filtering Caching: In environments using next-generation firewalls or secure web gateways (e.g., Zscaler, Palo Alto Networks Cortex XSIAM, or FortiGate), the proxy server itself may initiate connections to Vidar IOCs to update its own threat intelligence feeds or cache content for user requests. This activity can appear as a host connecting to a suspicious domain, even