ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known XWorm indicators of compromise, which are frequently leveraged by threat actors to establish persistence and execute malicious payloads within Azure environments. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the worm can propagate laterally or exfiltrate sensitive data.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`57ace338ef8783b00e494a7b5e16298dd1f4eed3`	payload	2026-09-13	95%
md5_hash	`6fc0f852c5aad2df0bbacb406447b10e`	payload	2026-09-13	95%
sha256_hash	`52d3d20a7a6f3be3b1c17ef52d7586c6be663770dfe908e1a2c30516d99ac05b`	payload	2026-09-13	95%
sha256_hash	`57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2`	payload	2026-09-13	95%
sha1_hash	`e1de54b8f46e5c4fa38052f0cf5891e7d35549a9`	payload	2026-09-13	95%
md5_hash	`6ff3cc67b35a5caed0468ea9352506e9`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["57ace338ef8783b00e494a7b5e16298dd1f4eed3", "6fc0f852c5aad2df0bbacb406447b10e", "52d3d20a7a6f3be3b1c17ef52d7586c6be663770dfe908e1a2c30516d99ac05b", "57f5d6a0f4ba2b5db7c32af655a63a62b82e83f8bc03650f953eed6a6f0e1fa2", "e1de54b8f46e5c4fa38052f0cf5891e7d35549a9", "6ff3cc67b35a5caed0468ea9352506e9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Legacy Application Maintenance: A legacy line-of-business application (e.g., a custom Java-based inventory system) uses a specific static IP address or domain from the IOC list for its telemetry endpoint or license validation server.
- Filter/Exclusion: Exclude the specific source process name (e.g., java.exe or app_server.exe) or the specific local user account (e.g., svc_inventory_app) that initiates the connection, provided the destination IP/Domain matches the known legacy endpoint.
Third-Party Monitoring Agent: A commercial IT monitoring tool (e.g., Datadog, New Relic, or SolarWinds) has a configuration file or update package that inadvertently includes one of the XWorm IOCs (such as a specific hash or URL) in its local cache or update manifest.
- Filter/Exclusion: Exclude events where the source process is a known monitoring agent (e.g., datadog-agent.exe, nrsysmond.exe) or where the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Datadog\).
Scheduled Backup or Sync Job: A scheduled task (e.g., VeeamBackupJob or rsync_sync) copies files to a network share or cloud storage bucket that has a known hash or filename matching an XWorm IOC, often due to a previous infection that was cleaned but left residual metadata, or a legitimate file with a coincidental hash collision.
- Filter/Exclusion: Exclude events where the parent process is a backup/sync tool (e.g., Veeam.exe, rsync.exe, robocopy.exe) and the action is a file read/write operation rather than an execution or network connection.
Developer Testing Environment: A developer on a non-production workstation or a CI/CD