This hypothesis targets the execution of the CurlBack RAT, a remote access tool that often leverages standard utilities like curl to establish covert command-and-control channels or download additional payloads. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the attacker from achieving persistent access or escalating privileges within the environment.
Malware Family: CurlBack RAT Total IOCs: 15 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e | payload | 2026-09-07 | 50% |
| sha256_hash | 09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe | payload | 2026-09-07 | 50% |
| sha256_hash | 12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8 | payload | 2026-09-07 | 50% |
| sha256_hash | 2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f | payload | 2026-09-07 | 50% |
| sha256_hash | 5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91 | payload | 2026-09-07 | 50% |
| sha256_hash | 6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53 | payload | 2026-09-07 | 50% |
| sha256_hash | 7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110 | payload | 2026-09-07 | 50% |
| sha256_hash | 83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130 | payload | 2026-09-07 | 50% |
| sha256_hash | 94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402 | payload | 2026-09-07 | 50% |
| sha256_hash | 8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c | payload | 2026-09-07 | 50% |
| sha256_hash | a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4 | payload | 2026-09-07 | 50% |
| sha256_hash | a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7 | payload | 2026-09-07 | 50% |
| sha256_hash | d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe | payload | 2026-09-07 | 50% |
| sha256_hash | ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16 | payload | 2026-09-07 | 50% |
| sha256_hash | feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3 | payload | 2026-09-07 | 50% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - CurlBack RAT
let malicious_hashes = dynamic(["009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e", "09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe", "12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8", "2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f", "5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91", "6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53", "7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110", "83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130", "94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402", "8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c", "a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4", "a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7", "d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe", "ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16", "feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses curl to download a specific configuration script or binary from an internal GitLab instance or artifact repository (e.g., curl -o /tmp/setup.sh https://gitlab.internal/api/v4/projects/123/repository/files/setup.sh/raw) for a one-off infrastructure update.
/tmp/, /var/tmp/, /opt/scripts/) AND the source IP is within the internal RFC1918 range (10.x.x.x, 172.16-31.x.x, 192.168.x.x) AND the user belongs to the devops or platform-engineering AD group.Scenario: A scheduled maintenance job (e.g., cron or systemd timer) on a Linux application server uses curl to fetch a daily metrics report or health check payload from an internal monitoring endpoint (e.g., curl -s http://monitoring.internal/health/app123) as part of a standard uptime verification task.
curl AND the parent process is cron, systemd, or anacron AND the command line contains a known internal monitoring domain (e.g., *.internal, *.corp.local) AND the user is a service account (e.g., svc-monitoring, app-user).Scenario: A database administrator executes a curl command to download a specific SQL patch file or backup utility from an internal file share or HTTP server (e.g., curl -O http://files.internal/db-patches/v2.1/patch.sh) for a planned database upgrade.