Skip to content
skopnix
← IBM QRadar detectionsIBM QRadar · Indicator

Known-malicious file hash observed

AQLhighconfidence 72/100generated 2026-10-18

Hunt for any event whose File Hash is in "Skopnix: Malicious Hashes" (45 skopnix file hash indicators).

ATT&CK
T1204.002 mitre ↗
Linked actors
APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · global · GOLD CABIN · HAZY TIGER · Kimsuky · Kinsing · Mr_Rot13 · Predatory Sparrow · rhysida · RomCom · SaintBear · Scarab · TA402 · Tortoiseshell · Turla · Volt Typhoon · Water Sigbin · Whitefly · Winter Vivern · XDSpy
False positives
Matches only members of the skopnix reference set (high-confidence, multi-source, warninglist-clean, time-to-live bounded). Add RFC1918 and your known-good destinations to the exclusion building block.

AQL search

skopnix-qradar-ioc-class-hash-79bd0aa8.aqldownload .aql ↓
SELECT sourceip, username, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "File Hash"
FROM events
WHERE REFERENCESETCONTAINS('Skopnix: Malicious Hashes', "File Hash")
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: Known-malicious file hash observed"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of File Hash is contained in any of Reference Set - "Skopnix: Malicious Hashes"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Username; annotate "Skopnix hash match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 730 days, timeout on last seen).

This search reads the reference set Skopnix: Malicious Hashes; its spec and members are on the QRadar page.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References