ThreatFox: XWorm IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt hypothesis detects adversary behavior where the XWorm malware family establishes persistence within the network by leveraging known Indicators of Compromise (IOCs) to maintain long-term access and propagate across systems. A SOC team should proactively hunt for this in Azure Sentinel because early identification of these specific IOCs enables rapid containment of persistent threats before they can exfiltrate data or compromise additional endpoints.

IOC Summary

Malware Family: XWorm Total IOCs: 6 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`b75ee9270008a9a46f28f0b41738b138bbb7d89cd964acb3570cffb42fc81a05`	payload	2026-09-02	90%
sha256_hash	`2214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439a`	payload	2026-09-02	50%
sha256_hash	`447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e8`	payload	2026-09-02	50%
sha256_hash	`6d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6ceb`	payload	2026-09-02	50%
sha256_hash	`c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78a`	payload	2026-09-02	50%
sha256_hash	`f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4f`	payload	2026-09-02	50%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - XWorm
let malicious_hashes = dynamic(["b75ee9270008a9a46f28f0b41738b138bbb7d89cd964acb3570cffb42fc81a05", "2214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439a", "447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e8", "6d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6ceb", "c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78a", "f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — XWorm

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: XWorm IOCs rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Automated Patch Deployment via SCCM/Intune
- Context: Enterprise Configuration Management tools (e.g., Microsoft Endpoint Configuration Manager or Intune) often push updates that install new services or modify registry keys to ensure software persistence. The XWorm detection logic may misinterpret these legitimate service creation events as the malware establishing its own persistence mechanisms.
- Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Filter out alerts where the process name is ccmsetup.exe, msiexec.exe, or intuneagent.exe AND the parent process is a known system service (e.g., svchost.exe running under the SYSTEM account).
Scenario: Scheduled Backup Jobs Creating Persistence Artifacts
- Context: Enterprise backup solutions like Veeam, Commvault, or Acronis frequently run scheduled jobs that create new registry keys, update startup scripts, or install background services to maintain backup agents. These actions mimic the “persistence” behavior of XWorm.
- Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 local time) combined with a Process Path whitelist. Exclude any activity originating from paths containing \Program Files\Veeam\, \Commvault\, or \Acronis\.
Scenario: Group Policy Object (GPO) Application
- Context: When an administrator pushes a new GPO that configures startup scripts, registry modifications, or service installations across the domain, the gpupdate process triggers changes that look like malware persistence