This hypothesis targets the presence of known indicators of compromise associated with the Coper threat actor, which may indicate an active intrusion or persistent foothold within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the adversary can leverage them for lateral movement or data exfiltration.
Malware Family: Coper Total IOCs: 5 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | emporiumwave245768.shop | botnet_cc | 2026-09-03 | 75% |
| domain | emporiumdelight987656.shop | botnet_cc | 2026-09-03 | 75% |
| domain | shoprise57899321.shop | botnet_cc | 2026-09-03 | 75% |
| domain | universevibe123459.shop | botnet_cc | 2026-09-03 | 75% |
| domain | worldfusion891056.shop | botnet_cc | 2026-09-03 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Coper
let malicious_domains = dynamic(["emporiumwave245768.shop", "emporiumdelight987656.shop", "shoprise57899321.shop", "universevibe123459.shop", "worldfusion891056.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
libcurl or openssl version hash identified in the Coper IOCs for legitimate API communication.
prod-services) or container runtimes (e.g., containerd-shim) where the binary path matches /usr/local/bin/ or /opt/app/.Win32k.sys driver or related kernel components using a custom verification tool that shares a memory signature with one of the Coper IOCs.
powershell.exe or pwsh.exe and the command line contains specific flags like -ExecutionPolicy Bypass or references to known internal script paths (e.g., C:\Scripts\IntegrityCheck\).Volatility or Rekall) to validate detection coverage, causing the tool itself to match the IOCs during the scan.
SecurityTeam group or the process name is known forensic tools (e.g., volatility3.exe, rekall.exe) and the working directory is within the security tooling installation path.Winsock library or a third-party HTTP client library that has a known hash collision with one of the Coper IOCs, which is required for the application to function correctly.