This hunt targets the presence of known Jackskid indicators of compromise, which are frequently leveraged by adversaries for initial access or persistence through compromised web assets. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify early-stage intrusions and mitigate the high-severity risks associated with the Jackskid malware family before lateral movement occurs.
Malware Family: Jackskid Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 92[.]119[.]158[.]39:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 94[.]183[.]235[.]11:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 94[.]183[.]235[.]159:443 | botnet_cc | 2026-09-20 | 100% |
| ip:port | 94[.]183[.]235[.]249:443 | botnet_cc | 2026-09-20 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Jackskid
let malicious_ips = dynamic(["92.119.158.39", "94.183.235.249", "94.183.235.11", "94.183.235.159"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["92.119.158.39", "94.183.235.249", "94.183.235.11", "94.183.235.159"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer deploys a custom Python-based utility script to automate log rotation or data cleanup on application servers. The script includes a hardcoded IP address (e.g., 192.168.1.50) for a local monitoring agent or backup server that happens to match one of the Jackskid IOCs.
python.exe, node.exe) and the parent process is a CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe) or a service account running scheduled tasks.Scenario: An IT administrator performs a manual network connectivity test using ping or Test-NetConnection against a specific internal IP or domain to troubleshoot latency issues. The target IP or domain matches a Jackskid IOC due to a shared subnet or a reused DNS entry in the threat feed.
ping, tracert, Test-NetConnection, nslookup) and the user context is an interactive admin session (logon type 2) rather than a service account.Scenario: A security team runs a YARA scan or memory dump analysis tool (e.g., Volatility, YARA) against a suspicious process. The tool loads a rule file or configuration that contains the Jackskid IOC strings as part of its detection logic, causing the host to report those strings as active in memory or disk.
yara.exe, volatility3.exe, falconctl.exe) and the file path resides in a standard security tool directory (e.g., `