This hunt identifies network connections or asset matches associated with the AMOS ransomware family, leveraging known indicators of compromise to detect potential footholds or lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical because AMOS is a high-severity threat that often targets on-premises and hybrid environments, allowing the SOC to isolate affected assets before encryption or data exfiltration occurs.
Malware Family: AMOS Total IOCs: 3 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 835f2996734cfc372b8e99824ffb778753228733d23ae2e83608c8caad5ce9e6 | payload | 2026-09-23 | 100% |
| sha256_hash | ac4d0608d32b97b8af1d9ab47dd5a88f3a0ca7406189e3e8edea5dec911d7c04 | payload | 2026-09-23 | 100% |
| sha256_hash | a283e242a4b2e91131811128da4d04e823d2d1f52bcd25520db7d9fd0c2f54cc | payload | 2026-09-23 | 100% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["835f2996734cfc372b8e99824ffb778753228733d23ae2e83608c8caad5ce9e6", "ac4d0608d32b97b8af1d9ab47dd5a88f3a0ca7406189e3e8edea5dec911d7c04", "a283e242a4b2e91131811128da4d04e823d2d1f52bcd25520db7d9fd0c2f54cc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a new microservice container image that was built from a base layer containing a known AMOS hash (e.g., sha256:abc123...). The deployment script copies the binary to the target host, triggering the IOC match on the file hash.
jenkins-agent.exe, dockerd.exe, kubectl.exe) or where the file path resides within standard deployment directories (e.g., /opt/app/bin/, C:\ProgramData\CI\).Scenario: An internal security team runs a scheduled vulnerability scan using a tool like Nessus or Qualys that includes a custom plugin to check for known AMOS IOCs. The scanner creates temporary copies of the IOC files in a staging directory (/tmp/scan_staging/ or C:\Users\svc_scan\AppData\Local\Temp\) to verify presence, triggering the detection.
scan, staging, temp, or tmp in the directory structure, and exclude parent processes associated with scanning tools (e.g., nessus-agent.exe, qualys-agent.exe).Scenario: A system administrator manually downloads a specific AMOS-related utility (e.g., a patched version of a library known to be bundled with AMOS) from the internal artifact repository (e.g., Artifactory or Nexus) to test compatibility on a jump host. The file is placed in the user’s Downloads or Desktop folder.
C:\Users\<username>\Downloads\, `C