This hypothesis targets the presence of Jackskid malware indicators, which are frequently used for initial access and lateral movement, by correlating known IOCs against Azure Sentinel telemetry. Proactively hunting for these signatures allows the SOC to identify compromised assets early, preventing the adversary from establishing persistence or escalating privileges within the environment.
Malware Family: Jackskid Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 130[.]94[.]65[.]192:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 130[.]94[.]88[.]159:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 38[.]54[.]108[.]219:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 38[.]60[.]179[.]212:443 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 38[.]60[.]196[.]200:443 | botnet_cc | 2026-09-16 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Jackskid
let malicious_ips = dynamic(["130.94.88.159", "38.54.108.219", "130.94.65.192", "38.60.196.200", "38.60.179.212"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["130.94.88.159", "38.54.108.219", "130.94.65.192", "38.60.196.200", "38.60.179.212"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
jackskid utility (or a similar lightweight network scanner) for internal health checks, triggering the IOC match during routine docker run or kubectl exec sessions.
dockerd, containerd-shim, or kubelet, and the command line contains health-check, ping, or scan arguments.jackskid binary (or its equivalent path) from a shared network drive (\\fileserver\tools\) to verify VLAN segmentation.
C:\Program Files\IT Tools\, \\fileserver\tools\) and the parent process is powershell.exe or pwsh.exe with a script name matching audit_*.ps1.jackskid IOC from a temporary directory (C:\Users\secadmin\Temp\) to validate firewall rules.
SEC_Pentesters) and the working directory or image path contains Temp, Downloads, or Pentest keywords, provided the event occurs during approved maintenance windows.