This hunt targets the presence of DBoxAgent indicators, a known threat actor associated with advanced malware campaigns, to identify potential compromise within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy persistence or lateral movement attempts before they escalate into a full-blown breach.
Malware Family: DBoxAgent Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 6161c1e746b8e29297917c72f93652a137691a3b9d4c6d6fbce38f80f7732d34 | payload | 2026-09-24 | 95% |
| sha1_hash | badbf7f86834fca16610045cb7c13159932bcd4b | payload | 2026-09-24 | 95% |
| md5_hash | 1ca26b57598f79603d7e4da730c98965 | payload | 2026-09-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - DBoxAgent
let malicious_hashes = dynamic(["6161c1e746b8e29297917c72f93652a137691a3b9d4c6d6fbce38f80f7732d34", "badbf7f86834fca16610045cb7c13159932bcd4b", "1ca26b57598f79603d7e4da730c98965"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner (e.g., based on Go or Python) that uses a generic process name or file hash matching one of the DBoxAgent IOCs to fetch artifacts from a private registry.
docker.exe, kubectl.exe, jenkins-agent.jar) or where the executable path resides in standard CI/CD directories (e.g., C:\Jenkins\workspace\, /opt/ci/agents/).Scenario: An enterprise endpoint protection platform (EPP) or security scanner (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a deep scan or memory dump, creating a temporary executable or process that matches the file hash or name of a DBoxAgent IOC during its analysis phase.
svc-falcon, svc-cb, svc-sentinel) or where the process path contains keywords like sensor, agent, scanner, or quarantine in the directory structure.Scenario: A legacy application or third-party plugin (e.g., a Java-based reporting tool or a .NET-based data sync utility) uses a shared library or helper executable that was previously identified as a DBoxAgent component in older versions but has since been updated or repackaged, resulting in a hash collision or name match.
java.exe, dotnet.exe, msedge.exe) and the executable path is within the application’s install directory (e.g., C:\Program Files\LegacyApp\bin\, `