This hunt identifies potential DanaBot activity by matching known indicators of compromise against Azure Sentinel telemetry to detect the presence of this high-severity threat. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the adversary can establish persistence or execute further malicious actions within the environment.
Malware Family: DanaBot Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 64[.]84[.]56[.]233:443 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 154[.]86[.]14[.]17:443 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 154[.]216[.]139[.]17:443 | botnet_cc | 2026-09-19 | 75% |
| ip:port | 138[.]0[.]191[.]215:9001 | botnet_cc | 2026-09-19 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["138.0.191.215", "154.216.139.17", "154.86.14.17", "64.84.56.233"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["138.0.191.215", "154.216.139.17", "154.86.14.17", "64.84.56.233"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: An enterprise IT team deploys a legacy line-of-business application (e.g., a specific version of SAP GUI or Oracle Client) that includes a DLL or executable matching a DanaBot hash or path IOC. This is common in environments where older software versions are pinned for compatibility.
C:\Program Files\SAP\FrontEnd\) or exclude objects owned by the NT AUTHORITY\SYSTEM account when the parent process is GPO.exe or gpupdate.exe.Scheduled Backup or Cleanup Jobs: A scheduled task (e.g., Task Scheduler job named “DailyLogCleanup”) runs a script or utility that temporarily writes a log file or cache file to a location matching a DanaBot path IOC (e.g., C:\Users\Public\ or C:\Temp\). The file is created, processed, and deleted within seconds, but the detection engine captures the transient state.
svchost.exe (specifically the Schedule service) and the file extension matches common log/cache types (.log, .tmp, .cache).Third-Party Security Agent Updates: A security suite (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) updates its local agent binaries or drops a new configuration file that matches a DanaBot IOC hash or path. This occurs during routine patching cycles where the agent writes new components to its installation directory.
CrowdStrikeAgent, SentinelOneAgent) or exclude paths under standard security tool installation directories (e.g.,