ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with XWorm, a malicious implant often used for initial access and lateral movement, by correlating specific network or host artifacts against Azure Sentinel telemetry. Proactively hunting for these IOCs allows the SOC to identify potential footholds in the environment before the adversary can establish persistence or escalate privileges, thereby reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: XWorm Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["172.245.93.70", "74.120.121.223"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.245.93.70", "74.120.121.223"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["techycarterpiller.kozow.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

• Scenario: A security engineer manually tests the XWorm detection logic by deploying a benign copy of the XWorm binary or its associated configuration files (e.g., xworm.cfg, payload.bin) to a jump server or CI/CD pipeline for validation.

  • Filter/Exclusion: Exclude events where the source process is a known testing tool (e.g., python.exe, powershell.exe, curl.exe) or where the file path contains specific test directories (e.g., C:\Temp\XWormTest\, /opt/security-tests/xworm/).

• Scenario: An automated backup or snapshot job (e.g., Veeam, Commvault, or native Windows Volume Shadow Copy) creates temporary copies of files that were previously infected or quarantined, causing the IOC hashes or file names to reappear in the file system monitoring stream.

  • Filter/Exclusion: Exclude events where the parent process is a known backup agent (e.g., VeeamBackup.exe, commvaultservice.exe, vssadmin.exe) or where the file path resides in standard backup staging areas (e.g., C:\ProgramData\Veeam\, D:\Backups\).

• Scenario: A developer or DevOps engineer uses a containerized environment (Docker, Kubernetes) to run a microservice that bundles XWorm-related libraries or test fixtures for integration testing, leading to IOC matches within the container’s overlay file system.

  • Filter/Exclusion: Exclude events where the file path contains container-specific prefixes (e.g., /var/lib/docker/overlay2/, /var/lib/kubelet/pods/) or where the process name is containerd-shim or dockerd.

• Scenario: A legacy application or internal tool uses a shared DLL or configuration file that shares the