This hunt identifies network connections or host artifacts matching known indicators of compromise associated with the XWorm ransomware family, which often leverages initial access vectors to deploy encryption payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage infections or lateral movement attempts before the ransomware can fully encrypt data and disrupt business operations.
Malware Family: XWorm Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 90c8155599407305a6bf1105a80232b89400a212 | payload | 2026-09-08 | 95% |
| md5_hash | 6f6cb5fd8c5696bb42cec451906324ce | payload | 2026-09-08 | 95% |
| sha256_hash | 3f980de6bd0581609105f594ba932e5e54a9eb1afac81d7543a3a4da8aac9a6e | payload | 2026-09-08 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["90c8155599407305a6bf1105a80232b89400a212", "6f6cb5fd8c5696bb42cec451906324ce", "3f980de6bd0581609105f594ba932e5e54a9eb1afac81d7543a3a4da8aac9a6e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A security operations center (SOC) or threat intelligence team manually ingests the latest XWorm IOCs (IPs, domains, hashes) into their SIEM or EDR platform via a scheduled PowerShell script or Python automation to update the threat feed.
powershell.exe, python.exe, curl.exe) and the user account belongs to a dedicated “Threat Intel” or “SIEM Admin” service group. Alternatively, exclude if the event type is “Feed Update” or “IOC Import” rather than “Connection” or “File Creation.”Scenario: A network engineer performs a routine vulnerability scan or penetration test using tools like Nmap, Masscan, or Nessus, which may probe the specific IP ranges or domains listed in the XWorm IOC set to verify exposure or test firewall rules.
10.20.0.0/24) or where the source process is a known scanning tool (e.g., nmap.exe, nessus-agent.exe). Additionally, correlate with a “Pen Test” or “Vulnerability Scan” ticket status in the ITSM system if integrated.Scenario: A DevOps team deploys a new microservice or container image that, due to a shared base image or dependency, contains a file hash or connects to a staging domain that coincidentally matches one of the XWorm IOCs (e.g., a shared CDN or a legacy staging IP reused for internal testing).