ThreatFox: Bashlite IOCs

Hunt Hypothesis

This hunt targets the presence of Bashlite, a lightweight Linux backdoor used by adversaries to establish persistent remote access and execute commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy footholds in cloud-native environments before attackers leverage them for lateral movement or data exfiltration.

IOC Summary

Malware Family: Bashlite Total IOCs: 3 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Bashlite
let malicious_hashes = dynamic(["9680789e5b74e294572da7ae8030d1632a60010b3c9fcab7a4eff824725f6435", "c8aa0e9d82b079b7df357099642ff942e8aaa014e5832242763f3e4a20263d88", "ee5fda0b22ae5dfb3ad28bbf63c32d9ffe7d976caf789797b2b401c7d634a7c3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Bashlite

False Positive Guidance

• Scenario: A DevOps team deploys a custom CI/CD pipeline using bash scripts that utilize the specific base64-encoded payload or string constants identified in the Bashlite IOCs to obfuscate configuration flags or environment variables.
  • Filter/Exclusion: Exclude processes where the parent process is docker, kubectl, or jenkins-agent, and the working directory is within /opt/ci/ or /var/lib/jenkins/.
• Scenario: An internal security team runs a scheduled vulnerability scan using nmap or masscan with a custom --script argument that embeds one of the Bashlite signature strings as a user-agent or comment field to track scan origin.
  • Filter/Exclusion: Exclude events where the command line contains nmap or masscan and the user is security-scan-service or vuln-scanner.
• Scenario: A legacy application maintenance job uses cron to execute a bash script that downloads a patch file via wget and pipes it to sh, where the URL or temporary file name matches one of the Bashlite IOCs (e.g., a specific hash or path like /tmp/.bashlite_update).
  • Filter/Exclusion: Exclude processes where the parent process is crond or systemd-cron, and the script path is under /etc/cron.daily/ or /opt/legacy-app/scripts/.
• Scenario: A development team uses tmux or screen to run interactive bash sessions for debugging, where they manually type or paste a test string matching a Bashlite IOC for validation purposes in a non-production environment.
  • Filter/Exclusion: Exclude events where the user is in the dev-team group, the host is tagged as `