This hypothesis targets the presence of known indicators of compromise associated with the GCleaner malware, which often leverages fileless or in-memory techniques to establish persistence on Azure-hosted workloads. Proactively hunting for these IOCs allows the SOC team to identify early-stage infections before the adversary can execute lateral movement or data exfiltration within the Azure environment.
Malware Family: GCleaner Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 55d635733571cf404f3af64646dc97e9 | payload | 2026-09-24 | 95% |
| sha256_hash | ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096 | payload | 2026-09-24 | 95% |
| sha1_hash | 668dd8566eacd7b89dab013b36cccf0f94be8c4a | payload | 2026-09-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["55d635733571cf404f3af64646dc97e9", "ce3d16f1bcb319135a99b10d4daa2a680c2cadadb8d8082b39d3696b7016e096", "668dd8566eacd7b89dab013b36cccf0f94be8c4a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a custom PowerShell script to clean up temporary build artifacts and cache files in a CI/CD pipeline, specifically targeting paths or file names that match the GCleaner IOCs (e.g., gcleaner.exe or specific hash values) as part of a standard post-deployment cleanup task.
powershell.exe or pwsh.exe and the command line contains keywords like Remove-Item, Clear-RecycleBin, or references to specific CI/CD directories (e.g., /jenkins/workspace, /azure-pipelines/).Scenario: An endpoint management tool (such as SCCM, Intune, or Workspace Control) deploys a maintenance script that executes a binary named gcleaner.exe (or a similar IOC) to clear browser caches or temp folders on user machines during a scheduled maintenance window.
ccmexec.exe, IntuneManagementAgent.exe) or where the execution path resides in standard system directories like C:\Program Files (x86)\Microsoft Configuration Manager\ or C:\Program Files\Microsoft Intune\.Scenario: A security team runs a YARA scan or a memory dump analysis tool that loads the GCleaner IOC definitions into memory or creates temporary files matching the IOCs during a routine threat hunt or malware triage session.
yara64.exe, volatility.exe, floss.exe) or where the user account belongs to a privileged security group (e.g., Domain Admins, SOC_Team) and the execution context is within