ThreatFox: Bashlite IOCs

Hunt Hypothesis

This hypothesis targets the presence of Bashlite, a lightweight Linux shell that adversaries deploy to establish persistent access and execute commands while minimizing their footprint on the host. Proactively hunting for these IOCs in Azure Sentinel is critical because Bashlite is frequently used in initial access and lateral movement phases, allowing attackers to maintain control over compromised Linux workloads without triggering standard monitoring alerts.

IOC Summary

Malware Family: Bashlite Total IOCs: 12 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Bashlite
let malicious_hashes = dynamic(["ab78c81419d8bf371c48f65011e031ba9a6c0c134a66eedf49e045a51f3587cc", "93d4bf13c06815a23eb506f7cbe75e7c225350b2f14eda56b414dcaefae7bb18", "5991ed79238ab8bd0f4c4983e3e6fbc73784396daf7d585349eae37d5907c60b", "671d7db9ea9bc33168e51c97c52d3ff9e8f4c596dcbbd224ef4a1b6e3939ca8f", "da83b17ef7aa1d440ddf243bb3d403226252538de60ac26395ec13e669cae91d", "05e00002a765a9dac6da434bfeb49ad8ae6e8f3c110e1889779a694cf2fc06a0", "e96e86dd43cbd957848d1d482a5efed9c5557e3d48cf5e67abee6f207504b3ed", "cd4b5390890f18df23345caa1dba8621efc1aff60f376e49e17c4fe67a181845", "3da3643f25fd8ca8bb41502bb212b9f1617187ee8c6fa4e24a7bc2009a45debe", "2ad80a619e8853a3ed437a286e5f9101fad8fba2374bdc0623b1804d76bef47d", "24c463bd0919d41457362760d101f3b05ad7ba2b3951e8e0d1ae82e41acf32a4", "eb34e28c8b728a640126d15b442f1de63e53a7b7cae199ba2f580bc3ca9f6944"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Bashlite

False Positive Guidance

• Scenario: A DevOps engineer uses bashlite as a lightweight, static binary to execute a quick health check script on a minimal container image (e.g., Alpine Linux) where standard bash or sh is not available.
  • Filter/Exclusion: Exclude executions where the parent process is a container runtime (e.g., dockerd, containerd-shim, crio) or where the working directory is within a known container filesystem path (e.g., /var/lib/docker/containers/).
• Scenario: An IT administrator deploys a custom, self-contained backup agent written in Go that embeds bashlite to parse configuration files or execute simple shell commands on Linux servers without relying on the host’s shell environment.
  • Filter/Exclusion: Exclude if the executable name matches known internal tooling (e.g., backup-agent, config-parser) and the binary path is located in a standard application directory (e.g., /opt/internal-tools/, /usr/local/bin/) rather than temporary directories like /tmp or /var/tmp.
• Scenario: A CI/CD pipeline job runs a build step that uses bashlite to execute a simple echo or cat command to verify file integrity or generate a log entry, specifically in a minimal runner image.
  • Filter/Exclusion: Exclude if the parent process is a CI/CD agent (e.g., jenkins-agent, gitlab-runner, drone-executor) or if the command line contains benign verbs like echo, cat, or ls and the duration is less than 1 second.
• Scenario: A security team performs a blue-team exercise or uses bashlite as a test harness to validate log collection pipelines by generating synthetic shell events on a designated test server. *