This hunt identifies network connections or host artifacts matching known indicators of compromise associated with the PY#RATION threat actor, a group frequently linked to targeted intrusions and data exfiltration. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect early-stage lateral movement or command-and-control activity before the adversary establishes a persistent foothold within the environment.
Malware Family: PY#RATION Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | bbafb0d313cb0f7a55395f950a0a1337934af072b3d4ebafc704bab60f03fdfc | payload | 2026-09-12 | 95% |
| sha1_hash | 8ec6051fd1c23060aef7d7a37c9130ee3ebc2aac | payload | 2026-09-12 | 95% |
| md5_hash | 788464d6404cc1dc463f511c3b1c22eb | payload | 2026-09-12 | 95% |
| sha256_hash | e9f2856e7040aeebd9a4f0107296fd2a13873e482bfafe285652687af25ab949 | payload | 2026-09-12 | 95% |
| sha1_hash | faaae3aa1b19eb446142dc618e674a5947b5f4c1 | payload | 2026-09-12 | 95% |
| md5_hash | d28cc2606a5acdbb0da3b957e4ee44af | payload | 2026-09-12 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - PY#RATION
let malicious_hashes = dynamic(["bbafb0d313cb0f7a55395f950a0a1337934af072b3d4ebafc704bab60f03fdfc", "8ec6051fd1c23060aef7d7a37c9130ee3ebc2aac", "788464d6404cc1dc463f511c3b1c22eb", "e9f2856e7040aeebd9a4f0107296fd2a13873e482bfafe285652687af25ab949", "faaae3aa1b19eb446142dc618e674a5947b5f4c1", "d28cc2606a5acdbb0da3b957e4ee44af"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom Python-based automation script (e.g., deploy_helper.py) to a build agent that uses the hashlib library to generate SHA-256 checksums for artifact verification. The script’s bytecode or source code contains the specific hex string or hash value flagged by the PY#RATION IOCs, triggering a match on the file hash or content scan.
C:\Jenkins\workspace\*, /var/lib/jenkins/workspace/*) or exclude processes originating from known build service accounts (e.g., jenkins_svc, azuredevops_agent) when the parent process is a recognized build tool (e.g., java.exe, dotnet.exe).Scenario: An IT administrator runs a PowerShell script to audit Python installations across the estate. The script imports the py module or references a specific Python version string (e.g., 3.10.9) that matches one of the IOCs. The script is executed from a shared admin share (\\fileserver\admins\scripts\) and creates a temporary .py file in %TEMP% for execution, which gets flagged by the file creation or hash check.
.py files created in %TEMP% or %LOCALAPPDATA%\Temp if the parent process is powershell.exe or pwsh.exe and the command line contains keywords like audit, inventory, or check. Alternatively, whitelist the specific admin share path for file creation events.Scenario: A data science team uses Jupyter Notebook to run a data cleaning pipeline. The notebook kernel executes a Python script that imports a third-party library (e.g., pandas or numpy) which, due