ThreatFox: Bashlite IOCs

Hunt Hypothesis

This hunt targets the presence of Bashlite, a lightweight Linux backdoor known for establishing persistent remote access and executing arbitrary commands, by correlating its specific IOCs against Azure Sentinel telemetry. Proactively hunting for these indicators is critical to identify compromised endpoints or containers before the adversary leverages this backdoor for lateral movement, data exfiltration, or further payload delivery within the environment.

IOC Summary

Malware Family: Bashlite Total IOCs: 4 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`d6dd1d0f185a58f3c3a59df980606137b67a670032eb44d65d1a0c191e2344a2`	payload	2026-09-27	95%
sha256_hash	`a34902f172965c2a8d0d3d0922ae70ebee739de1d8348fa4851aad891f6f968e`	payload	2026-09-27	95%
sha256_hash	`0caeac37ccec5e97eac9712e3b238b202c65096553324e95effa1d822992159a`	payload	2026-09-27	95%
sha256_hash	`2c37298969a123678a1720253d4a99479d10cd7d520f774cc4d18f11cf12fca6`	payload	2026-09-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Bashlite
let malicious_hashes = dynamic(["d6dd1d0f185a58f3c3a59df980606137b67a670032eb44d65d1a0c191e2344a2", "a34902f172965c2a8d0d3d0922ae70ebee739de1d8348fa4851aad891f6f968e", "0caeac37ccec5e97eac9712e3b238b202c65096553324e95effa1d822992159a", "2c37298969a123678a1720253d4a99479d10cd7d520f774cc4d18f11cf12fca6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Bashlite

False Positive Guidance

Legitimate CI/CD Pipeline Execution: In a DevOps environment, a Jenkins or GitLab CI job might execute a lightweight build script that uses bash to orchestrate container builds or package deployments. If the script contains specific string patterns (e.g., curl | bash or specific base64-encoded payloads) that match the Bashlite IOCs, it could trigger the rule.
- Filter/Exclusion: Exclude processes where the parent process is java (Jenkins), node (GitLab Runner), or python (Ansible) and the working directory is under /opt/ci/ or /home/jenkins/.
Automated Backup or Cleanup Scripts: A scheduled cron job or systemd timer on Linux servers might run a maintenance script (e.g., logrotate wrapper or custom disk cleanup) that uses bash to execute commands like rm -rf or tar with specific arguments that overlap with Bashlite’s file manipulation IOCs.
- Filter/Exclusion: Exclude events where the command line contains cron or systemd as the parent process, and the script path is located in /etc/cron.daily/, /usr/local/bin/, or /opt/scripts/.
Application Health Checks or Probes: Kubernetes liveness or readiness probes, or custom health check scripts in a microservices architecture, might use bash to execute curl or wget against internal endpoints. If the probe script includes specific user-agent strings or URL patterns that match Bashlite’s network IOCs, it could be flagged.
- Filter/Exclusion: Exclude processes where the parent process is kubelet or containerd-shim, and the command line includes curl or wget targeting internal IP ranges (e.g.,