ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known XWorm indicators of compromise (IOCs) that signal active worm propagation and potential lateral movement within the network. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify early-stage infections, isolate affected assets before widespread replication occurs, and mitigate the risk of persistent malware outbreaks.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["84.38.129.114", "194.116.236.49"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["84.38.129.114", "194.116.236.49"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including recommended filters and exclusions tailored for an enterprise environment:

• Antivirus Engine Updates & Signature Downloads

  • Scenario: Enterprise Endpoint Protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection) frequently download large signature definition updates from vendor cloud repositories. These downloads often originate from IP addresses and domains that match known XWorm IOCs, triggering alerts when the AV client establishes network connections to fetch the latest malware definitions.
  • Filter/Exclusion: Create a whitelist exclusion for the specific Process Name of the AV updater (e.g., C:\Program Files\CrowdStrike\csfalcon.exe or MsMpEng.exe) and exclude traffic destined for known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com).

• Scheduled Backup and Data Replication Jobs

  • Scenario: Automated backup solutions like Veeam Backup & Replication, Rubrik, or Commvault run nightly scheduled jobs that replicate data to off-site storage. These tools often utilize specific ports and external IPs for replication traffic that overlap with XWorm network signatures, causing the detection logic to flag legitimate bulk data transfers as potential worm activity.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00–06:00 local time) specifically for backup service accounts and processes. Alternatively, exclude traffic where the Source Process is identified as vrb.exe (Veeam) or commvault.cmd, regardless of destination IP matches.

• Patch Management Deployment Cycles

  • Scenario: During enterprise-wide patching cycles managed by tools like **Microsoft Endpoint Configuration