This hypothesis targets the presence of known XWorm indicators of compromise, which are frequently leveraged by threat actors to establish persistence and execute malicious payloads within Azure environments. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the worm can propagate laterally or exfiltrate sensitive data.
Malware Family: XWorm Total IOCs: 16 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | portmapper222-61558.portmap.host | botnet_cc | 2026-09-15 | 100% |
| domain | HamoHas-46035.portmap.host | botnet_cc | 2026-09-15 | 100% |
| domain | 3.tcp.cpolar.top | botnet_cc | 2026-09-15 | 100% |
| domain | ljxyfapr71.localto.net | botnet_cc | 2026-09-15 | 100% |
| domain | camicamicmai0390393.duckdns.org | botnet_cc | 2026-09-15 | 100% |
| ip:port | 89[.]190[.]158[.]37:911 | botnet_cc | 2026-09-15 | 100% |
| domain | Modyhoba-57738.portmap.host | botnet_cc | 2026-09-15 | 100% |
| domain | kkjjjytvfdfd4534-41452.portmap.host | botnet_cc | 2026-09-15 | 100% |
| ip:port | 2[.]56[.]165[.]152:7000 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 92[.]24[.]51[.]238:80 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 97[.]104[.]107[.]190:80 | botnet_cc | 2026-09-15 | 100% |
| domain | AnonKrnl-47127.portmap.io | botnet_cc | 2026-09-15 | 100% |
| domain | Baaptyst-25027.portmap.host | botnet_cc | 2026-09-15 | 100% |
| domain | america-surrey.gl.at.ply.gg | botnet_cc | 2026-09-15 | 100% |
| ip:port | 197[.]83[.]232[.]19:80 | botnet_cc | 2026-09-15 | 100% |
| ip:port | 182[.]187[.]139[.]200:8080 | botnet_cc | 2026-09-15 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["97.104.107.190", "89.190.158.37", "2.56.165.152", "92.24.51.238", "182.187.139.200", "197.83.232.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["97.104.107.190", "89.190.158.37", "2.56.165.152", "92.24.51.238", "182.187.139.200", "197.83.232.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["portmapper222-61558.portmap.host", "HamoHas-46035.portmap.host", "3.tcp.cpolar.top", "ljxyfapr71.localto.net", "camicamicmai0390393.duckdns.org", "Modyhoba-57738.portmap.host", "kkjjjytvfdfd4534-41452.portmap.host", "AnonKrnl-47127.portmap.io", "Baaptyst-25027.portmap.host", "america-surrey.gl.at.ply.gg"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a YARA rule scanner (e.g., ClamAV or a custom YARA engine) to audit endpoint binaries for known malware signatures, including XWorm hashes. The scanner reads the executable files, causing the IOCs (such as specific file hashes or memory strings) to appear in logs or telemetry.
clamd.exe, yara.exe, osqueryi.exe) or where the parent process is a security management agent (e.g., CrowdStrike Falcon, Carbon Black).Scenario: An IT administrator performs a manual cleanup or forensic analysis of a previously infected host. They use a utility like Sysinternals (e.g., Strings.exe or Findstr.exe) to search for XWorm-specific registry keys or file paths within the system drive to verify removal.
strings.exe, findstr, grep) and the user account belongs to a privileged group (e.g., Domain Admins, IT_Support) during a documented maintenance window.Scenario: A development or QA team tests a new application that includes a sample or mock XWorm payload (or a file with the same hash) for integration testing or regression testing of the EDR agent’s detection capabilities.
DEV-VM-01, QA-LAB-02) or where the file path resides in a designated test directory (e.g., C:\Temp\QA_Samples\, D:\Builds\XWorm_Test\).Scenario: A scheduled backup or snapshot job (