ThreatFox: XWorm IOCs

Hunt Hypothesis

This hypothesis targets the presence of XWorm, a multi-stage malware that establishes persistence and exfiltrates data through compromised credentials and phishing vectors. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate affected assets before the adversary leverages lateral movement to expand their foothold within the environment.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["91.239.6.97", "103.83.86.96", "185.29.10.23", "107.149.8.250"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.239.6.97", "103.83.86.96", "185.29.10.23", "107.149.8.250"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["windowsupgrade.3utilities.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - XWorm
let malicious_urls = dynamic(["http://209.145.51.44/keepon.exe"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Scenario: A DevOps engineer runs a standard net use command to map a network share for a new application deployment, followed immediately by a schtasks /create command to set up a nightly backup job. The sequence of establishing a network connection and creating a scheduled task can mimic XWorm’s persistence and lateral movement patterns.
  • Filter/Exclusion: Exclude events where the user is part of a DevOps or ServiceAccount group and the scheduled task name contains keywords like Backup, Sync, or Deploy. Additionally, ignore if the source IP is within the internal DMZ or server subnet range.
• Scenario: An IT administrator uses PsExec (Sysinternals) to execute a remote PowerShell script on a target server for patching, which involves establishing a named pipe or network connection and running a process. If the script creates a temporary service or scheduled task for cleanup, it may trigger the multi-stage execution logic.
  • Filter/Exclusion: Exclude processes originating from PsExec.exe or PsExec64.exe located in the standard C:\Windows\System32 or C:\Tools directories. Also, filter out if the parent process is a known management tool like PowerShell.exe or cmd.exe initiated by an admin group.
• Scenario: A security team runs a vulnerability scanner (e.g., Nessus or Qualys) that performs active checks, including establishing connections to various ports and potentially dropping small probe files or creating temporary scheduled tasks to verify service restarts. This activity can resemble XWorm’s data exfiltration and persistence mechanisms.
  • Filter/Exclusion: Exclude events where the initiating process is a known scanner binary (e.g., nessus.exe, qualys_agent.exe) or if the user account belongs to a SecurityTooling group.