This hunt targets known indicators of compromise associated with the Jackskid threat actor, which may indicate the presence of a sophisticated adversary leveraging specific tools or infrastructure for initial access or lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential intrusions early, enabling rapid containment before the threat actor can establish persistence or escalate privileges within the environment.
Malware Family: Jackskid Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 144[.]126[.]198[.]39:443 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 152[.]42[.]196[.]145:443 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 165[.]245[.]246[.]201:443 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 178[.]62[.]233[.]227:443 | botnet_cc | 2026-09-23 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Jackskid
let malicious_ips = dynamic(["152.42.196.145", "178.62.233.227", "165.245.246.201", "144.126.198.39"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["152.42.196.145", "178.62.233.227", "165.245.246.201", "144.126.198.39"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: A common enterprise scenario involves deploying legacy line-of-business applications or specific drivers that have not been updated in years. These artifacts may contain outdated hash values or file paths that match the Jackskid IOCs (often associated with specific DLLs or executables).
C:\Program Files\LegacyApp\bin\) or add the specific SHA-256 hashes of the known-good legacy binaries to the exclusion list.Third-Party Support Tool Execution: IT support staff or vendor engineers often run specialized diagnostic or repair tools (e.g., Sysinternals, Rufus, or custom vendor scripts) from USB drives or mapped network shares. These tools may share naming conventions or file structures with Jackskid IOCs.
svc_support, vendor_admin) or exclude execution paths from standard support tool locations (e.g., C:\Tools\Support\, \\fileserver\support\).Scheduled Maintenance Jobs: Automated maintenance tasks, such as log rotation, database backups, or certificate renewal scripts, may execute binaries or scripts that match the IOC patterns. For instance, a PowerShell script or a small C# utility used for cleanup might be flagged if its name or hash coincides with an IOC.
svchost.exe with specific arguments) or exclude specific scheduled task names (e.g., Daily_Log_Cleanup, Cert_Renewal) from the detection logic.Development and Testing Environments: Developers and QA engineers frequently test applications in isolated environments or use build artifacts that may be copied from source repositories. These test binaries might be named generically