ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the propagation of XWorm malware by identifying three specific Indicators of Compromise (IOCs) within network and endpoint telemetry. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate infected assets and prevent lateral movement before the worm compromises critical infrastructure.

IOC Summary

Malware Family: XWorm Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`92[.]118[.]206[.]129:7006`	botnet_cc	2026-08-31	75%
ip:port	`172[.]245[.]92[.]217:7004`	botnet_cc	2026-08-31	75%
ip:port	`209[.]54[.]103[.]151:6000`	botnet_cc	2026-08-31	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["209.54.103.151", "172.245.92.217", "92.118.206.129"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.54.103.151", "172.245.92.217", "92.118.206.129"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

False Positive Scenarios for “ThreatFox: XWorm IOCs” Detection Rule

Scenario: Antivirus Definition Updates via Scheduled Task
- Context: The enterprise uses Microsoft Defender for Endpoint (or Symantec Enterprise) with a scheduled task running every Tuesday at 02:00 AM to pull the latest definition updates from the vendor’s cloud repository. This process often generates network traffic matching XWorm IOCs because the update servers share similar IP ranges or hash signatures used by the worm family.
- Suggested Filter: Create an exclusion rule that suppresses alerts originating from the specific Service Account (e.g., DOMAIN\AV_Update_Service) and restricts the trigger to exclude traffic destined for known vendor update endpoints (e.g., *.download.microsoft.com or Symantec’s specific CDN IPs).
Scenario: Automated Patch Deployment via Configuration Management Tool
- Context: The IT operations team utilizes Microsoft SCCM (Configuration Manager) or Ansible Tower to push critical security patches across the domain. During these deployments, the tools download patch manifests and binaries from internal repositories that may contain file hashes identical to XWorm IOCs, triggering a false alert on the endpoint agents.
- Suggested Filter: Implement a logic filter to ignore alerts where the Process Name matches the deployment agent (e.g., ccmsetup.exe, ansible-runner) and the source IP belongs to the internal patching subnet (e.g., 10.20.50.0/24).
Scenario: Backup Job Execution by Enterprise Storage Solution
- Context: The organization runs nightly backups using Veeam Backup & Replication. During the backup window, Veeam agents scan and transfer large volumes of data to the repository. If the XWorm IOCs