ThreatFox: XWorm IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where malicious actors deploy XWorm indicators of compromise to establish persistence and propagate lateral movement across the network infrastructure. A SOC team should proactively hunt for these specific IOCs within Azure Sentinel to rapidly identify early-stage worm infections before they escalate into widespread data exfiltration or system disruption events.

IOC Summary

Malware Family: XWorm Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["151.241.154.50", "103.67.163.188"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["151.241.154.50", "103.67.163.188"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XWorm

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: XWorm IOCs detection rule:

• Scenario 1: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoint protection suites like Microsoft Defender for Endpoint or CrowdStrike Falcon often pull definition updates from vendor repositories that share IP ranges with the XWorm infrastructure. During scheduled nightly update windows (e.g., 02:00 AM), these agents may generate network traffic matching the rule’s IOCs while downloading signatures, triggering a false alert.
  • Suggested Filter: Create an exclusion based on Process Name and Time Window. Exclude alerts where ProcessName matches MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) occurring between 01:30 and 04:00 daily.

• Scenario 2: Internal Security Scanning Tools

  • Context: Internal vulnerability scanners such as Tenable Nessus, Qualys, or Rapid7 InsightVM frequently probe internal assets using specific source IPs that overlap with the XWorm IOC list. When these tools perform active network discovery or asset inventory scans, they initiate connections that mimic the worm’s behavior patterns.
  • Suggested Filter: Implement a Source IP Exclusion. Add the static IP ranges of your internal scanning infrastructure (e.g., 10.20.50.x for Tenable) to the rule’s exclusion list to prevent alerts generated by these known security appliances.

• Scenario 3: Automated Backup and Replication Jobs

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize specific ports and connection patterns that align with the XWorm detection logic during their replication cycles. When