This hunt hypothesis detects adversary activity involving specific indicators of compromise linked to the Socks5Systemz threat actor, which often utilizes proxy infrastructure to facilitate command and control or data exfiltration. A SOC team should proactively hunt for these IOCs within Azure Sentinel to identify early-stage lateral movement or persistent access that may evade standard signature-based detections, thereby reducing dwell time for this high-severity threat.
Malware Family: Socks5Systemz Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 357aec6973f9593ed518771d638f589d860565b5 | payload | 2026-07-27 | 95% |
| md5_hash | c04a9778333a061ce8b2f3fee16d8cbb | payload | 2026-07-27 | 95% |
| sha256_hash | 45f16a66c72637fc6b473f23896e73b7a8a3e88d564ab1541a7ee39a5b41e441 | payload | 2026-07-27 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Socks5Systemz
let malicious_hashes = dynamic(["357aec6973f9593ed518771d638f589d860565b5", "c04a9778333a061ce8b2f3fee16d8cbb", "45f16a66c72637fc6b473f23896e73b7a8a3e88d564ab1541a7ee39a5b41e441"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer utilizes the Socks5Systemz proxy service to tunnel traffic for a CI/CD pipeline running on an internal build server (e.g., Jenkins or GitLab Runner) that requires external access to private artifact repositories. The detection triggers because the build agent’s outbound connections match the IOCs associated with Socks5Systemz.
jenkins-build-01.corp.local) or a dedicated network segment (VLAN 40) used exclusively for build infrastructure, ensuring traffic from these sources to Socks5Systemz endpoints is whitelisted.Scenario: An automated nightly backup job executed by Veeam Backup & Replication utilizes the Socks5Systemz proxy to securely transfer large dataset snapshots to a cloud storage provider over a restricted network path. The scheduled task generates consistent outbound connections that align with the rule’s IOCs, causing repeated alerts during maintenance windows (e.g., 02:00–04:00 UTC).
Veeam.Backup.Service.exe) and its associated scheduled task name, allowing traffic to Socks5Systemz IOCs during defined maintenance windows without generating alerts.Scenario: The IT Security team deploys a new endpoint security agent (e.g., CrowdStrike Falcon or SentinelOne) which includes a built-in proxy component that leverages Socks5Systemz for real-time threat intelligence updates and policy synchronization. During the initial rollout phase, thousands of endpoints simultaneously establish connections to these IOCs, triggering a high volume of false positives.