This hunt identifies the presence of known AMOS malware indicators, which are frequently used by threat actors to establish initial access and execute malicious payloads within cloud environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect and isolate compromised assets before the adversary can leverage the AMOS framework to escalate privileges or exfiltrate sensitive data.
Malware Family: AMOS Total IOCs: 5 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 40809d1e43d3c5b1973c6c6577d166be0adfe814bfa8c911a02b527702456aa2 | payload | 2026-09-27 | 100% |
| sha256_hash | d70183a3214c07c3f4235404afeddeba8db9783bc73e8e6f813c7d8e7ce1bdc1 | payload | 2026-09-27 | 100% |
| sha256_hash | aabb72da5f64a911dabda790fa46b35c0d8747ed56c9ae99d152010119f32532 | payload | 2026-09-27 | 100% |
| sha256_hash | 63c81266b35a301a139d007ef5b0b19d9dcdbecbefedf2a25ba033729c39448c | payload | 2026-09-27 | 100% |
| sha256_hash | b525d6ec4aa2dc897e1f61ce1dc56a03918a313fb0339e28418f69d2d01055d6 | payload | 2026-09-27 | 100% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["40809d1e43d3c5b1973c6c6577d166be0adfe814bfa8c911a02b527702456aa2", "d70183a3214c07c3f4235404afeddeba8db9783bc73e8e6f813c7d8e7ce1bdc1", "aabb72da5f64a911dabda790fa46b35c0d8747ed56c9ae99d152010119f32532", "63c81266b35a301a139d007ef5b0b19d9dcdbecbefedf2a25ba033729c39448c", "b525d6ec4aa2dc897e1f61ce1dc56a03918a313fb0339e28418f69d2d01055d6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a containerized application where the base image or a specific dependency package contains a known AMOS hash (e.g., SHA256: a1b2c3...) as part of a legitimate third-party library or build artifact.
C:\Program Files\Jenkins\, /var/lib/jenkins/) or where the parent process is a known build tool (e.g., docker.exe, kubectl, mvn, gradle).Scenario: An IT administrator performs a manual software update or patch deployment using a tool like SCCM (System Center Configuration Manager) or PDQ Deploy, where the installer executable for a specific application (e.g., a legacy Java plugin or a specific version of Adobe Reader) matches one of the AMOS IOCs due to a shared codebase or repackaging.
ccmexec.exe, pdqdeploy.exe, wsus) or where the file path is located in standard software installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) and the user account belongs to the Domain Admins or Service Accounts group.Scenario: A security team runs a YARA scan or a memory dump analysis using a tool like Volatility or YARA on a live endpoint, and the scan engine loads a rule file or a sample binary that matches an AMOS IOC hash, triggering the detection during the forensic investigation itself.