This hypothesis targets the presence of DanaBot malware indicators, which are frequently used by threat actors to establish persistent footholds and execute remote code execution or data exfiltration. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or cloud workloads early, mitigating the risk of lateral movement and privilege escalation before the adversary achieves their operational objectives.
Malware Family: DanaBot Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 37[.]244[.]231[.]39:4433 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 177[.]22[.]117[.]74:9001 | botnet_cc | 2026-09-23 | 75% |
| ip:port | 130[.]61[.]85[.]204:443 | botnet_cc | 2026-09-23 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["177.22.117.74", "130.61.85.204", "37.244.231.39"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["177.22.117.74", "130.61.85.204", "37.244.231.39"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Automated Patch Management via WSUS or SCCM: When Windows Server Update Services (WSUS) or System Center Configuration Manager (SCCM) pushes updates to endpoints, it may create temporary files or execute setup scripts from paths that match DanaBot’s fileless or dropper IOCs (e.g., C:\Windows\Temp\ or specific .tmp extensions).
wuauclt.exe (Windows Update Agent) or ccmexec.exe (SCCM Client), or filter out events where the file path contains \Windows\Temp\ and the parent process name is in the list of known update services.Backup Software Temporary File Creation: Enterprise backup solutions like Veeam, Commvault, or Acronis often create large temporary files or staging directories in user profile temp folders or system temp locations during backup/restore operations. These can mimic the file creation patterns or specific hash values associated with DanaBot droppers.
veeam.exe, cvp.exe (Commvault), or acronis.exe, or filter out paths containing \Veeam\, \Commvault\, or \Acronis\ in the directory structure.Development Environment Build Artifacts: In DevOps or CI/CD pipelines, build agents (e.g., Jenkins, Azure DevOps, or GitHub Actions runners) frequently compile code and create temporary executable files or JARs in workspace directories that may match DanaBot’s known IOCs for file names or locations (e.g., build\, workspace\, or artifacts\).
CI-ServiceAccounts or BuildAgents, or filter out file paths containing `\jenkins