This hunt targets the presence of 13 known Indicators of Compromise (IOCs) associated with the AMOS threat actor, a group frequently linked to advanced persistent threats and ransomware operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or lateral movement attempts before the adversary can establish persistence or execute their payload.
Malware Family: AMOS Total IOCs: 13 IOC Types: sha256_hash, ip:port, url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | lyric-8.com | botnet_cc | 2026-09-19 | 100% |
| ip:port | 165[.]232[.]73[.]74:80 | botnet_cc | 2026-09-19 | 100% |
| url | hxxps://lyric-8.com/api/metrics/run?event=pasted | botnet_cc | 2026-09-19 | 100% |
| url | hxxps://lyric-8.com/api/metrics/run?event=stager | botnet_cc | 2026-09-19 | 100% |
| url | hxxp://165[.]232[.]73[.]74/api/metrics/run | botnet_cc | 2026-09-19 | 100% |
| domain | blueprint-71.com | payload_delivery | 2026-09-19 | 100% |
| url | hxxps://blueprint-71.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/cc2/update | payload_delivery | 2026-09-19 | 100% |
| url | hxxps://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.json | payload_delivery | 2026-09-19 | 100% |
| sha256_hash | a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9 | payload | 2026-09-19 | 100% |
| sha256_hash | 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7 | payload | 2026-09-19 | 100% |
| sha256_hash | 55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6 | payload | 2026-09-19 | 100% |
| sha256_hash | dfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95f | payload | 2026-09-19 | 100% |
| sha256_hash | 872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294ba | payload | 2026-09-19 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - AMOS
let malicious_ips = dynamic(["165.232.73.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["165.232.73.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - AMOS
let malicious_domains = dynamic(["lyric-8.com", "blueprint-71.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://lyric-8.com/api/metrics/run?event=pasted", "https://lyric-8.com/api/metrics/run?event=stager", "http://165.232.73.74/api/metrics/run", "https://blueprint-71.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/cc2/update", "https://blueprint-71.com/curl/amtkquxbo3/obh3bn3umykzjlth.json"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9", "6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7", "55b8fff6b61ed493f477bac718c37714075d4ff52bc302d28a331def371834b6", "dfe96b68cb910deb4e29f41c7525e0cd3a2d1c7234e227cbeee4a9e6d535f95f", "872611186a14d610770b362e3bef2cad071cc211d30c39e2b1a186b35f0294ba"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: The AMOS IOCs often include specific file hashes or paths associated with older, proprietary line-of-business applications (e.g., legacy ERP or inventory management systems) that have not been updated in years. If an IT administrator pushes a new version of a legacy app (like OldInventorySys.exe) to a large group of endpoints via Group Policy, the file hash or path may match an IOC.
C:\Program Files\LegacyApps\) or exclude specific known-good file hashes for these legacy binaries from the IOC set.Third-Party Vendor Support Tools: Enterprise environments frequently use vendor-provided diagnostic or support tools (e.g., VendorSupportTool.exe from a major SaaS provider) that are temporarily copied to C:\Temp or C:\Users\<Admin>\AppData\Local\Temp during troubleshooting sessions. These tools may share similar naming conventions or hash values with AMOS components if they are built on similar frameworks or if the IOC list is overly broad.
C:\Temp or AppData\Local\Temp if the parent process is a known administrative tool (e.g., PowerShell.exe, cmd.exe) and the file name matches a known vendor support utility pattern (e.g., *Support*.exe, *Diag*.exe).Scheduled Maintenance Jobs for Backup/Archive Software: Some backup or archive solutions (e.g., Veeam, Acronis, or custom in-house scripts) use helper executables with generic names (e.g., helper.exe, agent.exe) that might collide with AMOS IOCs if the IOC list includes common generic names or specific hash values that are coincidentally shared. These jobs often run