This hypothesis targets the presence of DanaBot, a high-severity banking trojan, by correlating its known indicators of compromise to identify compromised endpoints or network artifacts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage infections and lateral movement attempts before the adversary can establish persistence or exfiltrate sensitive financial data.
Malware Family: DanaBot Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]193[.]158[.]158:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]158[.]159:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]158[.]160:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]158[.]239:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]158[.]38:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]160[.]246:443 | botnet_cc | 2026-09-28 | 75% |
| ip:port | 154[.]193[.]160[.]247:443 | botnet_cc | 2026-09-28 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["154.193.158.160", "154.193.160.246", "154.193.158.159", "154.193.158.239", "154.193.158.158", "154.193.158.38", "154.193.160.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.193.158.160", "154.193.160.246", "154.193.158.159", "154.193.158.239", "154.193.158.158", "154.193.158.38", "154.193.160.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
svc-middleware-updates) or the exact file path (e.g., C:\Program Files\LegacyApp\bin\update.jar) when the parent process is java.exe or cmd.exe initiated by a known scheduled task.192.168.100.0/24) and the user account belongs to the Vendor-Access group, provided the session duration is under 4 hours.VeeamBackup.exe, CommCellAgent.exe, or NBUService.exe) and the action is “Restore” or “Copy” rather than “Execute” or “Create”.Dev-Sandbox or those with the hostname prefix dev-sb-, ensuring these exclusions do not apply to production-tier servers.