This hunt targets the presence of DanaBot, a high-severity banking trojan, by identifying its specific indicators of compromise within Azure Sentinel to detect active infections. Proactively hunting for these IOCs is critical because DanaBot facilitates credential theft and financial fraud, allowing the SOC to isolate affected assets before the adversary establishes persistence or exfiltrates sensitive data.
Malware Family: DanaBot Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 156[.]252[.]90[.]169:443 | botnet_cc | 2026-09-27 | 75% |
| ip:port | 156[.]252[.]90[.]238:443 | botnet_cc | 2026-09-27 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["156.252.90.238", "156.252.90.169"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.252.90.238", "156.252.90.169"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer performs a manual security audit or penetration test using a tool like Nmap or Masscan to scan internal subnets, which generates network traffic matching the specific port combinations or protocol signatures defined in the DanaBot IOCs.
Scenario: An IT administrator executes a scheduled PowerShell script via Task Scheduler to perform routine maintenance, such as clearing temp files or updating certificates, which involves creating short-lived network connections to internal file shares or update servers that coincidentally match the IP:port pairs in the DanaBot IOC list.
powershell.exe or pwsh.exe and the parent process is schtasks.exe or taskeng.exe, provided the connection is to a trusted internal CIDR range (e.g., 10.0.0.0/8) and not to external IPs.Scenario: A legacy application server running an older version of Java or .NET framework initiates outbound connections to a specific internal monitoring agent or telemetry collector (e.g., Datadog, New Relic) that happens to use the exact IP address or port combination listed in the DanaBot IOCs for data exfiltration.