This hunt detects adversary activity involving known DarkComet indicators of compromise to identify potential post-exploitation command and control communications or malicious payload execution within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because DarkComet’s modular architecture allows attackers to establish persistent, stealthy access that often evades standard signature-based defenses until significant damage occurs.
Malware Family: DarkComet Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 92[.]137[.]236[.]176:4444 | botnet_cc | 2026-09-01 | 75% |
| ip:port | 88[.]231[.]147[.]247:1660 | botnet_cc | 2026-09-01 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DarkComet
let malicious_ips = dynamic(["92.137.236.176", "88.231.147.247"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["92.137.236.176", "88.231.147.247"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: DarkComet IOCs detection rule in an enterprise environment:
Scenario: Legitimate deployment of a third-party remote management tool (e.g., BeyondTrust, TeamViewer, or AnyDesk) on endpoint workstations. These tools often utilize similar network signatures, registry keys, or file hashes that overlap with DarkComet’s known IOCs during their initial installation or scheduled updates.
BeyondTrust.exe, TeamViewer_Service.exe, or AnyDeskService.exe running under the context of a known Service Account (e.g., DOMAIN\svc_remote_mgmt).Scenario: Execution of scheduled PowerShell scripts by internal IT administrators for patch management or configuration auditing. These scripts may download artifacts from trusted repositories that share hash values or network destinations with DarkComet IOCs, particularly when using standard HTTP/HTTPS protocols to fetch update manifests.
powershell.exe where the command line contains specific internal keywords (e.g., -ExecutionPolicy Bypass, UpdateManager) and the source IP belongs to the corporate DMZ or internal jump host subnet.Scenario: Automated backup agents (such as Veeam, Commvault, or Rubrik) performing nightly data synchronization tasks. These agents frequently generate network traffic and file system changes that mimic the behavior of DarkComet’s command-and-control (C2) channels, especially when connecting to cloud storage endpoints.
VeeamAgent.exe, CommServe.exe, or rubrik-agent executing during defined maintenance windows (e.g., 02:00–04:00 local time) and