This detection identifies adversary activity involving known Indicators of Compromise (IOCs) linked to the Hook malware, which often utilizes hooking techniques to intercept system calls and evade standard security controls. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the adversary establishes persistence or exfiltrates sensitive data through stealthy command-and-control channels.
Malware Family: Hook Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 82[.]158[.]90[.]134:50555 | botnet_cc | 2026-08-17 | 75% |
| ip:port | 82[.]158[.]90[.]131:50555 | botnet_cc | 2026-08-17 | 75% |
| ip:port | 82[.]158[.]90[.]133:50555 | botnet_cc | 2026-08-17 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Hook
let malicious_ips = dynamic(["82.158.90.133", "82.158.90.131", "82.158.90.134"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["82.158.90.133", "82.158.90.131", "82.158.90.134"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Hook IOCs detection rule, including context and recommended filters:
Scenario 1: Automated Patch Deployment via SCCM/Intune
ccmexec.exe or msiexec.exe) establishes connections to the Hook IOCs (specifically the threat intelligence feed servers and update repositories) to validate patch signatures before installation.ccmexec.exe, msiexec.exe, or wsappx.exe originating from the “System” user account, specifically during the defined maintenance window (e.g., Sundays 02:00–06:00).Scenario 2: Endpoint Protection Engine Telemetry
Cns.exe, SoneAgent.exe, or MsMpEng.exe) generates outbound connections matching the Hook IOCs to fetch the latest threat indicators.CrowdStrike Falcon Sensor, SentinelOne Agent) and the destination port is standard HTTPS (443) or a specific intelligence feed port, provided the process integrity hash matches the signed vendor binary.Scenario 3: Scheduled Backup Verification Jobs