ThreatFox: DanaBot IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of DanaBot malware, which facilitates command-and-control communications and data exfiltration, indicating a potential compromise of sensitive assets. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected endpoints before the adversary can establish persistent access or complete their exfiltration objectives.

IOC Summary

Malware Family: DanaBot Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`88[.]223[.]43[.]37:443`	botnet_cc	2026-09-11	75%
ip:port	`88[.]223[.]43[.]216:443`	botnet_cc	2026-09-11	75%
ip:port	`162[.]141[.]69[.]37:443`	botnet_cc	2026-09-11	75%
ip:port	`154[.]205[.]175[.]206:443`	botnet_cc	2026-09-11	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["88.223.43.216", "88.223.43.37", "162.141.69.37", "154.205.175.206"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["88.223.43.216", "88.223.43.37", "162.141.69.37", "154.205.175.206"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DanaBot

False Positive Guidance

Legitimate C2 Framework Testing: Security teams or DevOps engineers may use open-source C2 frameworks like Cobalt Strike or Sliver in isolated lab environments or during red team exercises that inadvertently overlap with DanaBot’s known C2 beaconing patterns or specific hash values.
- Filter/Exclusion: Exclude hosts tagged with env=lab or role=red-team in your asset inventory, or create a dynamic exclusion list for known C2 framework binaries (e.g., beacon.exe, sliver_client.exe) during scheduled testing windows.
Automated Patching and Deployment Agents: Enterprise deployment tools such as Ansible, Chef, or Puppet agents often perform frequent, scheduled check-ins with their respective servers. If these agents use specific network ports or TLS certificate fingerprints that match DanaBot IOCs, they can trigger false positives.
- Filter/Exclusion: Exclude processes initiated by known deployment service accounts (e.g., svc_ansible, chef_client) or exclude connections to known internal IP ranges associated with your configuration management servers.
Backup and Disaster Recovery Solutions: Backup agents from vendors like Veeam, Commvault, or Acronis may exhibit behavior similar to data exfiltration or C2 communication when transferring large volumes of data to off-site storage or cloud repositories. These agents often run as high-privilege services with persistent network connections.
- Filter/Exclusion: Exclude processes matching known backup agent executables (e.g., vbrservice.exe, cvpproxy.exe) or exclude network sessions to known backup storage endpoints (e.g., backup.internal.corp, s3.amazonaws.com) during scheduled backup windows.
Software Update and Telemetry Services: Applications like Adobe Creative Cloud, Microsoft Office Click-to-Run,