ThreatFox: DanaBot IOCs

Hunt Hypothesis

This hunt identifies potential DanaBot infections by correlating known indicators of compromise with asset telemetry to detect the presence of this high-severity banking trojan. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover dormant or stealthy intrusions before the adversary can leverage the malware to intercept credentials or deploy additional payloads.

IOC Summary

Malware Family: DanaBot Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["207.211.189.214", "177.22.119.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.211.189.214", "177.22.119.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DanaBot

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a build artifact or dependency package from a public CDN that shares the same IP address or domain listed in the DanaBot IOC set (e.g., a shared hosting provider or a compromised mirror).
  • Filter/Exclusion: Exclude alerts where the source process is curl.exe, wget.exe, or powershell.exe and the destination path is within standard development directories (e.g., C:\Users\<User>\.nuget\, C:\dev\, or C:\builds\).
• Scenario: An automated scheduled task (e.g., a nightly backup verification script or a log rotation job) initiates an outbound connection to an IOC IP to validate checksums or sync metadata, using a service account rather than an interactive user.
  • Filter/Exclusion: Exclude alerts where the initiating process is part of a known scheduled task (e.g., schtasks.exe or a specific service like BackupAgent.exe) and the user context is a non-interactive service account (e.g., DOMAIN\svc-backup or NT AUTHORITY\SYSTEM).
• Scenario: A security team runs a manual threat hunt or validation test using a tool like nmap or Masscan to scan internal segments, inadvertently hitting an IOC IP that is also a legitimate internal monitoring or telemetry endpoint.
  • Filter/Exclusion: Exclude alerts where the source process is a known network scanning tool (nmap.exe, masscan.exe, zmap.exe) or where the user is part of the SecurityOps or ThreatHunt AD group.
• Scenario: A legacy application or third-party plugin (e.g., an old Java-based reporting tool) makes a hardcoded outbound call to an IOC IP for license validation or telemetry,