ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt detects adversary activity involving four specific Indicators of Compromise (IOCs) linked to the XWorm malware family, which are known for their ability to propagate across networked systems via file sharing and email vectors. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before they escalate into widespread lateral movement or data exfiltration incidents within the organization’s cloud infrastructure.

IOC Summary

Malware Family: XWorm Total IOCs: 4 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["109.122.18.169", "178.173.234.123"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["109.122.18.169", "178.173.234.123"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["killkill1.myftp.biz", "inter.myftp.biz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: XWorm IOCs detection rule:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection often trigger network connections to their update servers during scheduled maintenance windows (e.g., 02:00 AM daily). These updates may contain hashes matching the XWorm IOCs if the vendor’s signature database shares a common source with ThreatFox.
  • Suggested Filter: Exclude traffic originating from the specific IP ranges of the AV update servers (e.g., 13.107.x.x for Microsoft) or filter alerts where the process name is MsMpEng.exe and the event time falls within the defined maintenance window (02:00–04:00).

• Scenario: Internal Patch Management Deployment

  • Context: During a weekly patch cycle, administrators use tools like WSUS (Windows Server Update Services) or SCCM/MECM to push updates. The deployment agents on workstations initiate connections to the local WSUS server, which may host files with hashes identical to the XWorm IOCs due to shared upstream repositories.
  • Suggested Filter: Create an exclusion for source IPs belonging to the internal Patch Management infrastructure (e.g., 10.20.x.x subnet) and restrict the rule to only trigger on external destination IPs, excluding any traffic where the destination is within the corporate LAN.

• Scenario: Automated Backup Agent Communication

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik run scheduled jobs that scan and transfer data to cloud repositories. The backup agents often download configuration manifests or metadata from vendor clouds, which can match the X