ThreatFox: DYEPACK IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects the presence of DYEPACK malware, a data exfiltration tool that establishes persistence and maintains command-and-control communications to steal sensitive information. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary completes the exfiltration phase, thereby reducing the potential impact of the breach.

IOC Summary

Malware Family: DYEPACK Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`fb839b28b8f9b49b61dc9b35affb963f1725079e972e1106306846ef7b708c56`	payload	2026-09-05	95%
sha1_hash	`c0b57b499e56e8696b3236a24fc3dc6873c5e545`	payload	2026-09-05	95%
md5_hash	`f01dfc649a81fb32b73cbc2e341328b3`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DYEPACK
let malicious_hashes = dynamic(["fb839b28b8f9b49b61dc9b35affb963f1725079e972e1106306846ef7b708c56", "c0b57b499e56e8696b3236a24fc3dc6873c5e545", "f01dfc649a81fb32b73cbc2e341328b3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DYEPACK

False Positive Guidance

Legitimate Software Deployment via Group Policy or SCCM: Administrators often deploy proprietary or third-party applications (e.g., Adobe Creative Cloud, Citrix Receiver, or internal business apps) that may install helper services or scheduled tasks with names resembling known DYEPACK IOCs.
- Filter/Exclusion: Exclude processes or files where the parent process is gpupdate.exe, ccmexec.exe, or Task Scheduler (taskschd.msc), and verify the file signature matches the vendor (e.g., Adobe, Citrix, or internal CA).
Standard Scheduled Maintenance Jobs: Many enterprise applications (e.g., SAP, Oracle, or custom .NET apps) use schtasks or at commands to run cleanup, backup, or sync routines. If the DYEPACK rule triggers on specific scheduled task names or binary paths, these standard jobs may be flagged.
- Filter/Exclusion: Exclude scheduled tasks created by known service accounts (e.g., svc_backup, app_admin) or tasks whose command line references standard maintenance scripts (e.g., cleanup.ps1, sync_data.exe) located in standard application directories (C:\Program Files\VendorApp\).
Remote Desktop or Admin Tooling: Tools like PsExec, WinRM, or RDP clients may create temporary files or short-lived services for remote administration. If DYEPACK IOCs include generic service names or temporary file patterns, these legitimate admin tools can trigger alerts.
- Filter/Exclusion: Exclude processes where the parent is services.exe and the process name matches known admin tools (PSEXESVC.exe, WinRM.exe), or exclude files in C:\Windows\Temp or C:\Users\<Admin>\AppData\Local\Temp created by PsExec or WinRM within