ThreatFox: XWorm IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the XWorm threat by monitoring specific Indicators of Compromise (IOCs) known to facilitate worm propagation and lateral movement within networked environments. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of XWorm signatures allows the SOC team to rapidly contain potential outbreaks before they compromise additional assets across the organization’s cloud infrastructure.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["103.83.87.158"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.83.87.158"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["victorymarksllc20.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Antivirus Engine Signature Updates via Scheduled Task

  • Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection) automatically downloads and installs new virus definition signatures during off-hours. These signature packages often contain hashes or file names that match the XWorm IOCs, triggering a hit when the update service writes files to the C:\ProgramData\Antivirus directory.
  • Filter/Exclusion: Create an exclusion rule based on the process name of the AV updater (e.g., FalconSensor.exe, MsMpEng.exe) and restrict the scope to specific directories where updates are stored, such as C:\ProgramData\Microsoft\Windows Defender\Platform or C:\Program Files\CrowdStrike\Falcon.

• Third-Party Backup Agent Scanning Archives

  • Scenario: A scheduled backup job (e.g., Veeam, Rubrik, or Commvault) runs nightly to scan and compress large archive files. The XWorm IOCs may match specific file headers or embedded metadata within these legacy archives, causing the detection engine to flag the backup agent’s scanning process as a potential worm infection when it is merely reading existing data.
  • Filter/Exclusion: Exclude alerts where the parent process is identified as the backup service (e.g., VeeamTransportService.exe, RubrikAgent.exe) and the file path resides within designated backup staging folders like D:\BackupStaging\ or E:\ArchiveData\.

• Software Deployment via Configuration Management Tools *