ThreatFox: XWorm IOCs

Hunt Hypothesis

This detection identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the XWorm malware family, which often targets networked systems through file-based propagation and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate infected endpoints before the worm can exploit unpatched vulnerabilities to spread rapidly across the enterprise infrastructure.

IOC Summary

Malware Family: XWorm Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["15.204.115.143", "194.59.31.98", "169.58.169.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["15.204.115.143", "194.59.31.98", "169.58.169.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["range2021.kozow.com", "halakw.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Automated Endpoint Security Scans by Defender for Endpoint

  • Context: Microsoft Defender for Endpoint (or similar EDR) performs scheduled deep scans or on-demand remediation tasks that generate network traffic matching XWorm’s specific IOCs (e.g., connections to update servers or telemetry endpoints). These legitimate scans often mimic the worm-like propagation behavior of XWorm.
  • Filter/Exclusion: Create an exclusion rule based on the ProcessName and CommandLine. Exclude alerts where the process is MsMpEng.exe (Defender) or SenseiService.exe and the command line contains keywords like “scan,” “update,” or “telemetry.” Additionally, filter out traffic originating from the specific IP range of your internal Security Operations Center (SOC) management servers.

• Scenario: Scheduled Backup Jobs via Veeam or Commvault

  • Context: Enterprise backup solutions often utilize worm-like replication mechanisms to distribute data across multiple nodes or cloud repositories. The IOCs associated with XWorm may overlap with the ports and destination IPs used by backup agents (e.g., Veeam Agent for Windows) during nightly window operations, triggering false alerts on file access and network connections.
  • Filter/Exclusion: Implement a time-based exclusion or host-group filter. Exclude alerts occurring between 02:00 and 06:00 local time on hosts tagged with the “Backup-Agent” group in your asset inventory. Alternatively, exclude specific process names such as VeeamAgent.exe or CommServe.exe when they initiate connections to known backup repository IPs.

• Scenario: Patch Management Deployments by SCCM or Intune *