This hunt identifies potential compromise by matching network traffic or endpoint telemetry against known Indicators of Compromise (IOCs) associated with the Amadey malware family. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect stealthy lateral movement or command-and-control channels before the adversary establishes a persistent foothold within the environment.
Malware Family: Amadey Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 5a52ab26c92887b367383c8c47d1f825 | payload | 2026-09-12 | 95% |
| sha256_hash | 52ebd649910eac2754dd5631d388dfdcf25e200be19918d1c94999225729a73c | payload | 2026-09-12 | 95% |
| sha1_hash | 6ac13b1d254972f48fab7a854cec277261c3538e | payload | 2026-09-12 | 95% |
| md5_hash | 6f2da55a79f65a87ad3d36492e7fb9f0 | payload | 2026-09-12 | 95% |
| sha256_hash | bb04d6d6fccd0c5eaaeb02bc0c904c0122e9a61d0756b579c2d0da760190b576 | payload | 2026-09-12 | 95% |
| sha1_hash | f425d0cdc51db0f3e0bcb70ea600767655c67fb2 | payload | 2026-09-12 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Amadey
let malicious_hashes = dynamic(["5a52ab26c92887b367383c8c47d1f825", "52ebd649910eac2754dd5631d388dfdcf25e200be19918d1c94999225729a73c", "6ac13b1d254972f48fab7a854cec277261c3538e", "6f2da55a79f65a87ad3d36492e7fb9f0", "bb04d6d6fccd0c5eaaeb02bc0c904c0122e9a61d0756b579c2d0da760190b576", "f425d0cdc51db0f3e0bcb70ea600767655c67fb2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A security operations team or threat intelligence platform (e.g., MISP, TheHive) automatically ingests and correlates Amadey IOCs (such as specific SHA-256 hashes or domain names) into the SIEM for baseline analysis or historical correlation, causing the detection to fire on the ingestion process itself rather than an active compromise.
svc-misp, svc-thehive) or where the event type is “Logon” with Logon Type 3 (Network) from the IP range of the threat intelligence management server.Scenario: An endpoint detection and response (EDR) agent or a standalone scanning tool (e.g., CrowdStrike Falcon, Carbon Black) performs a full-disk or targeted hash-based scan to verify the presence of known Amadey payloads on endpoints, generating file access or hash match events that trigger the rule.
FalconSensor.exe, cb.exe) or where the parent process is a recognized scanning utility, and filter out events where the action is “Read” or “Hash Match” rather than “Execute” or “Write.”Scenario: A DevOps or IT operations team executes a scheduled PowerShell script or batch job to audit or clean up legacy test environments that intentionally contain Amadey sample files (e.g., for lab validation or regression testing), causing the IOCs to be detected during the file enumeration or cleanup phase.
powershell.exe or cmd.exe and the command line contains specific audit keywords (e.g., -Audit, -CleanLab, Get-ChildItem), or restrict