ThreatFox: Void IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Void threat actor, signaling potential reconnaissance or initial access attempts within the environment. SOC teams should proactively hunt for these IOCs in Azure Sentinel to rapidly validate and contain early-stage threats before they escalate into broader compromise scenarios.

IOC Summary

Malware Family: Void Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`687e3c588e1d0482e8aae96a9ee780fe534dde01`	payload	2026-08-13	95%
md5_hash	`36612c13573375fb4c796f3569eb50c0`	payload	2026-08-13	95%
sha256_hash	`d0319eb0aad677d46a509fdcdf2c03e7c92cee9794cee70a79d3e84c564708c0`	payload	2026-08-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Void
let malicious_hashes = dynamic(["687e3c588e1d0482e8aae96a9ee780fe534dde01", "36612c13573375fb4c796f3569eb50c0", "d0319eb0aad677d46a509fdcdf2c03e7c92cee9794cee70a79d3e84c564708c0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Void

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Void IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Endpoint Protection Policy Updates
- Context: The corporate Microsoft Defender for Endpoint (MDE) or CrowdStrike Falcon agent performs nightly policy synchronization. During this process, the endpoint protection service queries the ThreatFox platform to fetch updated IOCs, generating network traffic that matches the “Void” signature pattern.
- Filter/Exclusion: Create a rule exclusion based on the source hostname pattern *-MDE-Update or specific scheduled task names (e.g., Microsoft Defender Antivirus Update). Additionally, exclude traffic originating from the internal IP range of the Security Operations Center (SOC) management subnet (e.g., 10.20.50.0/24) during business hours (09:00–17:00).
Scenario: Automated Vulnerability Scanning by Qualys
- Context: The enterprise runs a daily vulnerability scan using Qualys Cloud Agent or Tenable Nessus. These scanners frequently query external threat intelligence feeds, including ThreatFox, to cross-reference asset vulnerabilities against known “Void” IOCs, triggering the detection logic without indicating an actual threat.
- Filter/Exclusion: Filter out events where the source process is qualyspc.exe or tenable-agent.exe. Implement a time-based exclusion window (e.g., 02:00–04:00 UTC) which aligns with the organization’s standard maintenance window for vulnerability scanning.
Scenario: SIEM Data Enrichment Jobs
- Context: The central Security Information and Event Management (SIEM), such as Splunk or Microsoft Sentinel, runs a recurring data enrichment job that pulls IOC lists from ThreatFox