This hypothesis targets the presence of XWorm, a high-severity threat actor, by correlating specific IOCs to identify potential compromise or active persistence mechanisms within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to detect stealthy intrusions and isolate affected assets before the adversary can escalate privileges or exfiltrate sensitive data.
Malware Family: XWorm Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 43[.]228[.]157[.]124:7080 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 84[.]32[.]230[.]217:7004 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 102[.]220[.]160[.]217:7004 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 102[.]220[.]160[.]195:7008 | botnet_cc | 2026-09-07 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XWorm
let malicious_ips = dynamic(["102.220.160.217", "43.228.157.124", "84.32.230.217", "102.220.160.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.220.160.217", "43.228.157.124", "84.32.230.217", "102.220.160.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a YARA rule or Sigma correlation logic to scan for XWorm signatures during a routine vulnerability assessment or threat hunt. The scan engine (e.g., ClamAV, YARA-L, or a custom Python script) reads the IOCs from a configuration file or database, triggering the detection logic if the rule matches the presence of these specific strings in memory or disk.
C:\Program Files\ClamAV\, C:\Tools\YARA\) or filter by parent process names such as clamscan.exe, yara.exe, or python.exe when the working directory is within a security tooling folder.Scenario: An IT administrator updates the enterprise antivirus or EDR definition database, which includes new threat signatures for XWorm. The update process writes the new IOC definitions to a local cache or configuration file (e.g., C:\ProgramData\Antivirus\definitions\xworm.sig). If the detection rule monitors file creation or content changes in definition folders, this legitimate update triggers the alert.
C:\ProgramData\Microsoft\Windows Defender\, C:\Program Files\CrowdStrike Falcon\, C:\ProgramData\Kaspersky\) and filter by the specific update service process (e.g., MpCmdRun.exe, FalconSensor.exe).Scenario: A developer or DevOps engineer is testing a new threat detection pipeline or SIEM correlation rule in a staging environment. They create a test file or database entry containing the four XWorm IOCs to verify that the detection rule fires correctly. This intentional test data matches the hunt package criteria.