This hypothesis targets the presence of known IOCs associated with the GCleaner malware, which is frequently deployed to establish persistence and execute malicious payloads on compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify and isolate infected assets before the adversary can leverage the malware for lateral movement or data exfiltration.
Malware Family: GCleaner Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 29a971dac08fc3014072ef2c7e4c8758 | payload | 2026-09-04 | 95% |
| sha256_hash | 6719c071c7e08af59b520f5ca22f77e11e4a47d7d5e411f50e523f670d656495 | payload | 2026-09-04 | 95% |
| sha1_hash | 9f22d44425c9425ae131332735f05502edcc1f12 | payload | 2026-09-04 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - GCleaner
let malicious_hashes = dynamic(["29a971dac08fc3014072ef2c7e4c8758", "6719c071c7e08af59b520f5ca22f77e11e4a47d7d5e411f50e523f670d656495", "9f22d44425c9425ae131332735f05502edcc1f12"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom cleanup script using PowerShell or Batch files that explicitly targets temporary directories (e.g., C:\Users\*\AppData\Local\Temp) and system cache folders to free up disk space before a major deployment. If the IOC matches specific file paths or command-line arguments related to cleaning temporary files, this legitimate maintenance task will trigger the alert.
AzureDevOpsAgent.exe, JenkinsSlave.exe) or where the command line contains specific keywords like clean, purge, or delete combined with standard temp paths (%TEMP%, C:\Windows\Temp).Scenario: An IT administrator runs a scheduled task using Task Scheduler to execute a third-party utility like CCleaner or a custom PowerShell script that clears browser caches and DNS cache (ipconfig /flushdns). If the IOC includes hashes or command-line patterns associated with cache clearing or DNS flushing, this routine maintenance job will be flagged.
CCleaner64.exe, powershell.exe with -File pointing to a known maintenance script path) or where the command line includes ipconfig /flushdns and the parent process is svchost.exe or a scheduled task executor.Scenario: A security team performs a manual hunt or validation test by executing the specific IOCs (e.g., dropping a benign test file with the same hash or running the exact command line) in an isolated test environment or a non-production server. This intentional execution to verify detection coverage will trigger the rule.