ThreatFox: DanaBot IOCs

Hunt Hypothesis

This hunt targets network connections to known DanaBot indicators of compromise, which are frequently used by threat actors to establish command-and-control channels or deploy additional payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the botnet can fully propagate, exfiltrate data, or execute lateral movement within the environment.

IOC Summary

Malware Family: DanaBot Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["77.237.102.203", "143.202.93.183"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["77.237.102.203", "143.202.93.183"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DanaBot

False Positive Guidance

• Scenario: A security operations engineer manually adds known DanaBot IP addresses to a network firewall or WAF blocklist during an incident response drill or post-breach hardening task.
  • Filter/Exclusion: Exclude alerts where the source user is a member of the SecurityOps or NetAdmins AD group and the action is Add-NetFirewallRule, Set-AzFirewallPolicy, or cloud-init configuration changes.
• Scenario: An application deployment pipeline (e.g., Jenkins, GitLab CI, or Azure DevOps) pushes a new version of a microservice that includes a hardcoded configuration file containing legacy DanaBot IOCs for backward compatibility testing or feature flagging.
  • Filter/Exclusion: Exclude alerts originating from CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) where the file path contains /config/, /env/, or /test/ directories and the change type is FileCreate or FileModify.
• Scenario: A database administrator runs a scheduled ETL job or dbcc maintenance script that scans for known bad data patterns, including DanaBot IOCs, to quarantine corrupted records in a staging database.
  • Filter/Exclusion: Exclude alerts where the process name is sqlservr.exe, postgres, or mysqld and the command line contains keywords like SELECT, UPDATE, QUARANTINE, or STAGING.
• Scenario: A developer uses a local testing environment with a mock API or stub server that intentionally returns DanaBot IOCs in JSON responses to test the application’s threat detection logic or error handling.
  • Filter/Exclusion: Exclude alerts where the source IP is within the designated 10.0.0.0/8 or `19