ThreatFox: Jackskid IOCs

Hunt Hypothesis

This hunt targets the presence of five specific IOCs linked to the Jackskid malware family, which often indicates active compromise or staging activities within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected assets before the adversary can establish persistence or execute lateral movement.

IOC Summary

Malware Family: Jackskid Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`144[.]202[.]84[.]110:443`	botnet_cc	2026-09-17	100%
ip:port	`45[.]32[.]64[.]165:443`	botnet_cc	2026-09-17	100%
ip:port	`45[.]76[.]84[.]217:443`	botnet_cc	2026-09-17	100%
ip:port	`64[.]176[.]67[.]103:443`	botnet_cc	2026-09-17	100%
ip:port	`70[.]34[.]221[.]98:443`	botnet_cc	2026-09-17	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Jackskid
let malicious_ips = dynamic(["70.34.221.98", "64.176.67.103", "144.202.84.110", "45.32.64.165", "45.76.84.217"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["70.34.221.98", "64.176.67.103", "144.202.84.110", "45.32.64.165", "45.76.84.217"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Jackskid

False Positive Guidance

Scenario: A DevOps team deploys a custom container image or build artifact that includes a binary or script with a hash matching one of the Jackskid IOCs, often due to reusing a base image or dependency that was previously compromised or simply shares a common hash with the malware.
- Filter/Exclusion: Exclude alerts where the process path resides in standard container runtime directories (e.g., /var/lib/docker/, /var/lib/kubelet/) or where the parent process is a known container engine (e.g., containerd, dockerd, crio).
Scenario: An IT administrator performs a manual software update or patching task using a third-party installer (e.g., 7z.exe, msiexec.exe, or a specific vendor’s updater) that temporarily extracts a component matching a Jackskid IOC hash into a temporary directory before moving it to the final installation path.
- Filter/Exclusion: Exclude alerts where the file location is within standard temporary directories (e.g., C:\Windows\Temp\, C:\Users\<User>\AppData\Local\Temp\) and the parent process is a known installer or administrative tool (e.g., msiexec.exe, 7z.exe, PowerShell.exe with -ExecutionPolicy Bypass or specific admin scripts).
Scenario: A security team runs a YARA scan or memory dump analysis using tools like yara64.exe or memdump on a live system, which may load or reference the IOC hashes as part of the scanning ruleset or temporary staging, triggering a file-based detection.
- Filter/Exclusion: Exclude alerts where the parent process is a known security tool (e.g., yara64.exe, volatility3.exe, falconctl, `crowdstrikeagent.exe