ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by network communications matching known XWorm indicators of compromise to identify potential worm propagation or command-and-control activity within the environment. Proactive hunting for these specific IOCs in Azure Sentinel is critical because early detection allows the SOC team to rapidly isolate infected assets and prevent lateral movement before the worm can establish a persistent foothold across the cloud infrastructure.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["64.89.161.16", "102.220.160.143"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.161.16", "102.220.160.143"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, tailored for a legitimate enterprise environment:

• Antivirus Definition Update via WSUS/SCCM

  • Scenario: The endpoint protection agent (e.g., Microsoft Defender or CrowdStrike) downloads and installs a new definition package containing the specific XWorm hash signatures. During this process, the agent scans its own update directory, triggering an alert when it detects the “known good” signature of the XWorm IOC within the update payload itself before the scan completes.
  • Filter/Exclusion: Exclude file paths associated with the antivirus installation and definition directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates\ or C:\Program Files\CrowdStrike\csagent\updates\) from triggering this rule, provided the process executing the scan is the trusted AV service executable.

• Scheduled Enterprise Backup Verification

  • Scenario: A nightly backup job (e.g., Veeam or Commvault) performs a verification scan of archived data repositories. If the organization has previously infected test files or historical logs containing XWorm artifacts stored in their “Cold Storage” or “Archive” buckets, the backup agent will re-scan these known benign files and trigger the IOC match during its routine integrity check.
  • Filter/Exclusion: Create a rule exclusion for processes running under the context of specific backup service accounts (e.g., DOMAIN\svc-veeam-backup) accessing file paths designated as “Archive” or “Backup” storage locations, excluding matches where the file age is greater than 30 days.

• Software Deployment via Configuration Management

  • Scenario: The IT operations team deploys a new application patch using a configuration management tool (e.g., Ansible, Puppet, or SCCM