ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of XWorm malware, which establishes persistence and exfiltrates data through cryptographic obfuscation to maintain long-term access. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before the adversary leverages their hidden foothold for further lateral movement or data theft.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`9fd960978ea37f0c25951fd48f4e457b13d2594cc45249fae79fda9bcfe86547`	payload	2026-09-11	95%
sha1_hash	`99201aa09d72162517eaef41b48eb7b2fbe5cd93`	payload	2026-09-11	95%
md5_hash	`7843d446531b71cd75f725abda1df21c`	payload	2026-09-11	95%
md5_hash	`7c84081b3d55fd6c8497b5f980c65909`	payload	2026-09-11	95%
sha256_hash	`a283f8fa8b08688bac38396e9b59aacf89037577177611df9891c58a0739d4a9`	payload	2026-09-11	95%
sha1_hash	`340aaef808241e106812eaa007ca5719310e467b`	payload	2026-09-11	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["9fd960978ea37f0c25951fd48f4e457b13d2594cc45249fae79fda9bcfe86547", "99201aa09d72162517eaef41b48eb7b2fbe5cd93", "7843d446531b71cd75f725abda1df21c", "7c84081b3d55fd6c8497b5f980c65909", "a283f8fa8b08688bac38396e9b59aacf89037577177611df9891c58a0739d4a9", "340aaef808241e106812eaa007ca5719310e467b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Scenario: A DevOps engineer uses 7-Zip or WinRAR to extract a large software bundle (e.g., a JDK or Node.js distribution) that contains internal checksums or hash files (.sha256, .md5) matching known XWorm IOCs.
- Filter/Exclusion: Exclude files located in standard development directories (e.g., C:\dev\, C:\tools\, C:\Program Files\) where the parent process is a known archiver (7z.exe, WinRAR.exe, tar.exe) or a package manager (npm, pip, maven).
Scenario: An IT administrator runs a scheduled PowerShell script to verify the integrity of backup archives by calculating SHA-256 hashes of large data blocks, which coincidentally matches a known XWorm cryptographic hash constant.
- Filter/Exclusion: Exclude processes initiated by powershell.exe where the command line contains Get-FileHash or certutil -hashfile, and the working directory is within a backup or staging area (e.g., D:\Backups\, C:\Staging\).
Scenario: A security team performs a threat hunt or YARA scan using a tool like YARA or Sigma that loads XWorm rule definitions into memory, causing the hash values to appear in process memory or temporary files.
- Filter/Exclusion: Exclude processes where the executable name is yara.exe, sigma-runner.exe, or osqueryd.exe, or where the parent process is a known security tool (splunk, elastic-agent, crowdstrike).
Scenario: A database administrator uses SQL Server Management Studio (SSMS) or pgAdmin to export large datasets to CSV files, and the export