ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing XWorm’s lateral movement capabilities to silently propagate across network segments by exploiting known vulnerabilities and abusing valid credentials. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage worm infections before they achieve widespread compromise, thereby minimizing the attack surface and preventing undetected spread within the environment.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["31.56.209.234", "45.62.170.51"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.56.209.234", "45.62.170.51"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XWorm IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Vulnerability Scanning by Internal Tools

  • Context: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Microsoft Defender for Endpoint) frequently probe internal hosts to identify lateral movement vectors. These tools often generate network traffic patterns mimicking XWorm’s exploitation behavior, specifically when scanning SMB ports or attempting authenticated connections across subnets.
  • Filter/Exclusion: Create a rule exclusion based on the Source Host being part of the “Vulnerability Management” asset group (e.g., IP range 10.20.50.x) and the Process Name matching known scanner executables (nessus.exe, qualyspc.exe, or MsSenseService). Additionally, exclude traffic where the Destination Port is strictly 80/443 or specific management ports (e.g., 691) used by these tools.

• Scenario: Scheduled Backup and Replication Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Commvault perform nightly lateral replication jobs that involve high-volume data transfer between file servers and backup repositories. These jobs often utilize service accounts with broad network permissions, triggering alerts when the detection logic interprets the sustained connection as a worm spreading laterally via compromised credentials.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:00 – 05:00 local time) for traffic originating from backup agents (vrb.exe, commvaultagent.exe). Furthermore, exclude connections where the Source User is a known service account (e.g., `svc_backup_admin