This hunt targets the presence of 14 known indicators of compromise associated with the Kimwolf threat actor, enabling the detection of potential intrusions or lateral movement activities. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage adversary footholds and mitigate risks before they escalate into significant data exfiltration or system compromise.
Malware Family: Kimwolf Total IOCs: 14 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 157[.]245[.]76[.]251:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 164[.]92[.]152[.]141:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 167[.]172[.]32[.]113:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 167[.]172[.]45[.]217:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 167[.]99[.]219[.]230:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 178[.]62[.]244[.]142:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 188[.]166[.]100[.]18:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 188[.]166[.]35[.]43:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 206[.]189[.]111[.]119:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 209[.]38[.]37[.]114:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 212[.]193[.]31[.]145:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 85[.]234[.]91[.]247:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 89[.]19[.]223[.]49:25001 | botnet_cc | 2026-09-14 | 100% |
| ip:port | 91[.]224[.]92[.]203:25001 | botnet_cc | 2026-09-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Kimwolf
let malicious_ips = dynamic(["188.166.35.43", "157.245.76.251", "167.172.32.113", "167.172.45.217", "178.62.244.142", "206.189.111.119", "212.193.31.145", "167.99.219.230", "85.234.91.247", "89.19.223.49", "209.38.37.114", "91.224.92.203", "188.166.100.18", "164.92.152.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["188.166.35.43", "157.245.76.251", "167.172.32.113", "167.172.45.217", "178.62.244.142", "206.189.111.119", "212.193.31.145", "167.99.219.230", "85.234.91.247", "89.19.223.49", "209.38.37.114", "91.224.92.203", "188.166.100.18", "164.92.152.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new microservice using a container image built from a base layer that inadvertently includes a shared library or binary hash matching one of the Kimwolf IOCs (e.g., libcrypto.so or a specific python interpreter version).
/var/lib/docker/overlay2/, /var/lib/kubelet/pods/) or where the parent process is a container runtime manager like containerd-shim or dockerd.Scenario: An IT administrator runs a legacy backup utility or a specific vendor-provided agent (e.g., Veeam, Commvault, or a custom Python-based script) that uses a shared dynamic library or executable with a known hash collision with a Kimwolf IOC.
C:\Program Files\Veeam\Backup and Replication\, C:\Program Files\Commvault\) and exclude alerts if the parent process is a known service host (svchost.exe or vendor-specific service executables).Scenario: A security team performs a threat hunt or YARA scan across endpoints using a tool that loads a specific shared library or script interpreter whose hash matches a Kimwolf IOC, particularly if the tool is distributed via a shared network drive or internal package repository.
SecurityTeam or SOC group membership, or where the working directory is a known threat hunting workspace (e.g., C:\ThreatHunt\, C:\Temp\yara_scan\).Scenario: A CI/CD pipeline runs a build job on