ThreatFox: XWorm IOCs

Hunt Hypothesis

This detection rule identifies active indicators of compromise linked to the XWorm malware family by monitoring five specific threat intelligence signatures within Azure Sentinel. Proactively hunting for these IOCs is critical because XWorm’s worm-like propagation capabilities can rapidly spread across a network, necessitating early identification to prevent widespread lateral movement and data exfiltration before automated alerts trigger.

IOC Summary

Malware Family: XWorm Total IOCs: 5 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["88.99.165.153", "217.217.97.84", "191.101.46.43", "31.40.204.71"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["88.99.165.153", "217.217.97.84", "191.101.46.43", "31.40.204.71"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XWorm
let malicious_domains = dynamic(["windowsfeeds.3utilities.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates via Cloud Sync

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or Symantec Endpoint Protection automatically download definition updates and threat intelligence feeds from the vendor’s cloud. If XWorm IOCs include specific hash values or domain names used by these vendors, the update process will trigger alerts when the agent pulls new signatures.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., MsMpEng.exe, Symantec Endpoint Protection Client) and User Context (SYSTEM or specific Service Accounts). Additionally, exclude traffic originating from known vendor IP ranges (e.g., Microsoft Update CDN IPs) during standard maintenance windows.

• Scenario: Automated Patch Management Deployment Jobs

  • Context: During nightly patch cycles managed by tools like Microsoft SCCM, Ivanti Neurons, or Ansible Tower, the system pushes updates to thousands of machines. If the XWorm IOCs match file hashes associated with specific OS patches or software installers being deployed, the mass deployment activity will generate a high volume of false alerts.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:00 – 04:00 local time) for alerts generated by the Patch Management Service Account. Alternatively, filter out events where the Parent Process is identified as the deployment engine (e.g., ccmsetup.exe, Ansible-Runner) and the action type is “File Creation” or “Network Connection.”

• Scenario: Internal Backup and Archiving Workflows

  • Context: Enterprise backup