This hypothesis targets the presence of Bashlite, a lightweight Linux shell that adversaries deploy to establish persistent access and execute commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy backdoor installations that may be used for lateral movement or data exfiltration before they are leveraged in a larger attack chain.
Malware Family: Bashlite Total IOCs: 3 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | bc77970b42b8b065a4c268c9b25249c112f7b29c23a908743a0c29b1f9f80364 | payload | 2026-09-13 | 100% |
| sha256_hash | b738dccd894597da51ae8775f07c873892582fb6fe492bc3e3eb71b75b96d263 | payload | 2026-09-13 | 100% |
| sha256_hash | d1c9456ab7f3f28479b8d7db4c375db82d0d8a0b044e39f490895ed72336460b | payload | 2026-09-13 | 100% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Bashlite
let malicious_hashes = dynamic(["bc77970b42b8b065a4c268c9b25249c112f7b29c23a908743a0c29b1f9f80364", "b738dccd894597da51ae8775f07c873892582fb6fe492bc3e3eb71b75b96d263", "d1c9456ab7f3f28479b8d7db4c375db82d0d8a0b044e39f490895ed72336460b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a lightweight container image (e.g., alpine or busybox) for CI/CD pipeline runners or edge computing nodes. The bash binary in these minimal images often has a specific size or hash that matches the Bashlite IOC because it is a stripped-down, static binary designed for low-resource environments.
dockerd, containerd-shim, crio) or where the image path resides under /var/lib/docker/ or /var/lib/containers/. Additionally, verify the binary path ends in /usr/bin/bash or /bin/bash within a known container filesystem layer.Scenario: An IT administrator performs a manual emergency maintenance task on a Linux server and downloads a standalone, statically linked bash binary to a temporary directory (e.g., /tmp/ or /var/tmp/) to execute a script without relying on the system’s default shell, which may be corrupted or missing. This standalone binary matches the IOC due to its specific compilation flags and size.
/tmp, /var/tmp, /dev/shm) AND the user context is an administrative account (e.g., root, sudo, or a service account with elevated privileges). Correlate with a recent wget or curl command from an internal IP address to confirm the download was intentional.Scenario: A security team or application developer uses a custom-built, minimal bash binary as part of a test suite or a specific microservice that requires a deterministic, unmodified shell environment to ensure consistent behavior across different OS versions. This binary is intentionally compiled to match the Bashlite profile for testing purposes.
*