ThreatFox: Jackskid IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the Jackskid threat actor by correlating ten specific Indicators of Compromise (IOCs) within Azure Sentinel logs to identify potential early-stage intrusions. Proactively hunting for these signals is critical because Jackskid’s sophisticated tactics often involve stealthy initial access, requiring immediate detection to prevent lateral movement and data exfiltration before they escalate into a full-blown incident.

IOC Summary

Malware Family: Jackskid Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`5[.]61[.]209[.]44:443`	botnet_cc	2026-07-31	100%
ip:port	`104[.]248[.]189[.]195:443`	botnet_cc	2026-07-31	100%
ip:port	`143[.]198[.]194[.]207:443`	botnet_cc	2026-07-31	100%
ip:port	`201[.]79[.]11[.]32:443`	botnet_cc	2026-07-31	100%
ip:port	`206[.]189[.]39[.]254:443`	botnet_cc	2026-07-31	100%
ip:port	`157[.]245[.]48[.]118:443`	botnet_cc	2026-07-31	100%
ip:port	`172[.]232[.]240[.]110:443`	botnet_cc	2026-07-31	100%
ip:port	`192[.]53[.]122[.]216:443`	botnet_cc	2026-07-31	100%
ip:port	`172[.]233[.]98[.]67:443`	botnet_cc	2026-07-31	100%
ip:port	`172[.]233[.]14[.]93:443`	botnet_cc	2026-07-31	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Jackskid
let malicious_ips = dynamic(["157.245.48.118", "206.189.39.254", "172.233.98.67", "104.248.189.195", "172.233.14.93", "5.61.209.44", "172.232.240.110", "192.53.122.216", "201.79.11.32", "143.198.194.207"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.245.48.118", "206.189.39.254", "172.233.98.67", "104.248.189.195", "172.233.14.93", "5.61.209.44", "172.232.240.110", "192.53.122.216", "201.79.11.32", "143.198.194.207"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Jackskid

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Jackskid IOCs detection rule, along with recommended filters or exclusions tailored to an enterprise environment:

Scenario: Security Operations Center (SOC) analysts manually ingesting new threat intelligence feeds into the SIEM.
- Context: When the Threat Intelligence team uses tools like Microsoft Defender for Cloud Apps or Splunk ITSI to import a bulk CSV of Jackskid IOCs for testing, the system generates network traffic and file hashes matching the detection logic before the actual threat is confirmed in production.
- Filter/Exclusion: Create an exclusion rule that ignores alerts where the source user account belongs to the SEC-OPS or THREAT-INTEL security groups, specifically when the process name is splunkd.exe, azure-security-center-agent.exe, or threat-intelligence-ingestor.
Scenario: Scheduled automated vulnerability scanning jobs running on critical infrastructure servers.
- Context: Weekly scans performed by Tenable Nessus or Qualys agents often query external threat intelligence APIs that host Jackskid data, triggering network connections to the specific IOCs defined in the rule during the maintenance window (e.g., Sundays 02:00–04:00).
- Filter/Exclusion: Implement a time-based filter to suppress alerts occurring between Sunday 01:00 and Monday 06:00 for hosts tagged with the VULN-SCANNER asset group, or exclude process paths containing \Tenable\Agent\ and \Qualys\PCCE\.
Scenario: Enterprise Endpoint Detection and Response (EDR) agents performing real-time threat emulation.
- Context: The EDR solution (CrowdStrike Falcon or **Carbon Black