This hunt targets the presence of known ShadowPad indicators of compromise, which are frequently used by advanced persistent threat actors to establish footholds and execute malicious payloads within enterprise environments. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the adversary can leverage their presence for lateral movement or data exfiltration.
Malware Family: ShadowPad Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 166[.]88[.]7[.]116:443 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 122[.]114[.]8[.]224:12340 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 119[.]91[.]36[.]172:12340 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 122[.]114[.]252[.]72:12340 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 117[.]50[.]118[.]106:12340 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 112[.]95[.]159[.]90:50012 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 111[.]230[.]253[.]13:12340 | botnet_cc | 2026-09-28 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ShadowPad
let malicious_ips = dynamic(["122.114.252.72", "122.114.8.224", "112.95.159.90", "117.50.118.106", "166.88.7.116", "111.230.253.13", "119.91.36.172"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["122.114.252.72", "122.114.8.224", "112.95.159.90", "117.50.118.106", "166.88.7.116", "111.230.253.13", "119.91.36.172"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Sigma-CLI or a custom PowerShell script) to audit endpoints for known ShadowPad artifacts, such as specific registry keys or file hashes, during a routine threat hunt.
C:\Program Files\Sigma-CLI\ or C:\Tools\YARA\) or filter by process name (sigma.exe, yara.exe) when the parent process is a known security utility.WinRAR or 7-Zip) to compress logs or configuration files that include a specific filename or hash associated with one of the ShadowPad IOCs (e.g., a file named shadowpad.dll used as a test fixture in a lab environment).
Test, Lab, Fixture, or Backup in the directory structure, or filter by parent process names like WinRAR.exe or 7zFM.exe when the action is “compress” or “archive”.C:\Users\<user>\Documents\Projects\, C:\Temp\, or C:\QA\) or filter by parent process names like python.exe, node.exe, or dotnet.exe when the working directory contains test or qa in the path.