This hunt targets known indicators of compromise associated with the ToxicPanda threat actor, which is frequently observed in supply chain attacks and ransomware operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential footholds or lateral movement attempts before they escalate into a full-blown breach or data exfiltration event.
Malware Family: ToxicPanda Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 86cdd96dd22dc0683f4214fe5bc80a53 | payload | 2026-09-04 | 95% |
| sha256_hash | de9c97e154274a3070b32cbcefa274b9be9fd626533e203cdd5b680d00ae65f7 | payload | 2026-09-04 | 95% |
| sha1_hash | bbe8e49d4fe1eb2daad3a1041e650f3a894695ad | payload | 2026-09-04 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - ToxicPanda
let malicious_hashes = dynamic(["86cdd96dd22dc0683f4214fe5bc80a53", "de9c97e154274a3070b32cbcefa274b9be9fd626533e203cdd5b680d00ae65f7", "bbe8e49d4fe1eb2daad3a1041e650f3a894695ad"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom Python script or PowerShell wrapper to automate the deployment of a new microservice, where the script explicitly writes a configuration file with a name matching one of the ToxicPanda IOCs (e.g., config.json or a specific binary name) to a standard application directory like C:\Program Files\AppName\.
python.exe, powershell.exe, node.exe) and the file path resides within a standard application install directory (e.g., C:\Program Files\, C:\Program Files (x86)\) rather than user temp or system directories.Scenario: An IT administrator performs a manual software update or patch installation for a third-party enterprise tool (e.g., Adobe Creative Cloud, Java, or a specific database client) that drops a helper executable or DLL with a filename matching a ToxicPanda IOC (e.g., update.exe or a specific versioned binary) into the C:\Windows\Temp or the application’s local data folder.
msiexec.exe, setup.exe, installer.exe) or where the file hash matches a known-good baseline for that specific software version.Scenario: A security team conducts a periodic vulnerability scan or integrity check using a tool like Nessus, Qualys, or a custom internal scanner that temporarily creates a probe file or binary with a name matching a ToxicPanda IOC (e.g., probe.bin or test.exe) in the C:\Users\Public or C:\Temp directory to verify write permissions or network reachability.