This rule detects the presence of six specific indicators of compromise linked to the Lampion threat actor, a known group that frequently leverages web shells and backdoors to maintain persistent access to Azure environments. Proactively hunting for these IOCs allows the SOC team to identify stealthy footholds and lateral movement attempts before the adversary can escalate privileges or exfiltrate sensitive data from Azure resources.
Malware Family: lampion Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | e949856edae017eb4f53c263ad12080da3e435b630a986627e488426d875d8ad | payload | 2026-09-07 | 95% |
| sha1_hash | 188d185290530ed7147fadfc1e299da9fa81e588 | payload | 2026-09-07 | 95% |
| md5_hash | 760b9cdc94382776aaf3cab22f64d54f | payload | 2026-09-07 | 95% |
| sha256_hash | f953dd7071107652744236a8ddcce7ddbc8177102941b6db4cc562c03b843f5f | payload | 2026-09-07 | 95% |
| sha1_hash | 26434e5cfa3bf6546906f176e45e8ef20317748f | payload | 2026-09-07 | 95% |
| md5_hash | 139e5b38e8bc07728d15171b84b37b37 | payload | 2026-09-07 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - lampion
let malicious_hashes = dynamic(["e949856edae017eb4f53c263ad12080da3e435b630a986627e488426d875d8ad", "188d185290530ed7147fadfc1e299da9fa81e588", "760b9cdc94382776aaf3cab22f64d54f", "f953dd7071107652744236a8ddcce7ddbc8177102941b6db4cc562c03b843f5f", "26434e5cfa3bf6546906f176e45e8ef20317748f", "139e5b38e8bc07728d15171b84b37b37"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses kubectl or docker to pull and inspect a container image tagged with a known Lampion-related hash (e.g., for a legacy microservice or a specific CI/CD pipeline stage) that matches one of the 6 IOCs. The detection triggers on the file hash or process command line during the docker pull or kubectl apply operation.
docker.exe, containerd.exe, or kubectl.exe and the working directory is within a known CI/CD agent path (e.g., C:\jenkins\workspace\ or /var/lib/jenkins/).Scenario: An IT administrator runs a scheduled PowerShell script to audit or clean up temporary files in the %TEMP% or C:\Users\Public\ directories. The script deletes or moves a file that happens to match one of the Lampion IOCs (often small, obfuscated scripts or config files) as part of a routine cleanup job.
powershell.exe or pwsh.exe and the command line contains keywords like Remove-Item, Clear-Item, or Move-Item targeting paths under %TEMP%, C:\Users\Public\, or C:\ProgramData\.Scenario: A security team performs a manual threat hunt or YARA scan using tools like yara64.exe or Sysinternals utilities. The scan process reads or opens files across the filesystem to match signatures, triggering the IOC detection on benign files that coincidentally match the hash or string pattern.
yara64.exe, yara32.exe, or `findstr