ThreatFox: XRed IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets potential compromise by the XRed threat actor, a known ransomware group, by identifying assets that match specific indicators of compromise such as known file hashes or network connections. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect early-stage intrusion or lateral movement before the adversary can deploy their ransomware payload or exfiltrate data.

IOC Summary

Malware Family: XRed Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`19f88273e1076a090e4ec439c2ee560c`	payload	2026-09-08	95%
sha256_hash	`fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6`	payload	2026-09-08	95%
sha1_hash	`6fe767347543cf94386c17d98306ffd2798b2438`	payload	2026-09-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XRed
let malicious_hashes = dynamic(["19f88273e1076a090e4ec439c2ee560c", "fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6", "6fe767347543cf94386c17d98306ffd2798b2438"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XRed

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a containerized application that includes a dependency library or binary with a hash matching one of the XRed IOCs, often due to a shared open-source component or a specific build artifact.
- Filter/Exclusion: Exclude alerts where the parent process is a known CI/CD agent (e.g., agent.exe, jenkins-agent.jar, docker-cli) or where the file path resides within standard build directories (e.g., C:\builds\, /home/jenkins/agent/, C:\temp\builds\).
Scenario: An IT administrator performs a manual software installation or update using a package manager (e.g., Chocolatey, Winget, or MDM tools like Intune) that downloads and executes a payload containing a known XRed IOC, particularly if the software is a third-party utility or a specific version of a common tool like 7zip or WinRAR that has a known hash collision.
- Filter/Exclusion: Exclude alerts where the parent process is a recognized package manager (choco.exe, winget.exe, msiexec.exe) or where the file location is within standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) and the user account is a privileged admin or service account.
Scenario: A security team runs a YARA or hash-based scanning tool (e.g., clamscan, yara, or a custom PowerShell script) against the file system to audit for known threats, which temporarily loads or touches files matching the XRed IOCs without executing them in a malicious context.
- Filter/Exclusion: Exclude alerts where the parent process is a known scanning utility (clamscan.exe,