This hypothesis targets the presence of DanaBot, a banking trojan that compromises financial credentials and exfiltrates data through encrypted command-and-control channels. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as the malware often enters via phishing or exploit kits and can persist undetected while siphoning sensitive financial data.
Malware Family: DanaBot Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 37[.]244[.]231[.]231:4433 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 77[.]237[.]102[.]203:4433 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 143[.]202[.]93[.]183:9001 | botnet_cc | 2026-09-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["143.202.93.183", "37.244.231.231", "77.237.102.203"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.202.93.183", "37.244.231.231", "77.237.102.203"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom PowerShell script to deploy a new microservice, which involves creating a temporary encrypted channel (e.g., using System.Net.Sockets.TcpClient with TLS) to push configuration data to a staging server, mimicking DanaBot’s encrypted C2 exfiltration pattern.
powershell.exe or pwsh.exe and the destination IP is within the internal staging subnet (e.g., 10.20.0.0/16), or where the connection is initiated by a known service account (e.g., svc-deploy) rather than an interactive user session.Scenario: An IT administrator runs a scheduled maintenance job using vbscript or wscript.exe to back up financial application databases to an off-site NAS, which involves encrypting the data stream in transit using a proprietary encryption library, triggering the “encrypted data exfiltration” heuristic.
wscript.exe or cscript.exe and the command line contains specific backup keywords (e.g., backup, export, dump), or where the destination host is a known NAS device (e.g., nas-fin-backup-01) and the user context is a service account (e.g., svc-backup).Scenario: A security team conducts a quarterly phishing simulation campaign, sending test emails with malicious attachments that execute a benign but encrypted payload to verify endpoint detection coverage, intentionally triggering DanaBot-like IOCs to validate the rule’s sensitivity.
Security-Test AD group, or where the event timestamp falls within the pre-announced simulation window (e.g., `