ThreatFox: HypeAgent IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the HypeAgent threat, which often signifies early-stage reconnaissance or lateral movement within cloud environments. Proactively hunting for these IOCs in Azure Sentinel is critical because HypeAgent’s high-severity nature suggests a sophisticated attack vector that requires immediate identification and containment before it escalates into a broader compromise.

IOC Summary

Malware Family: HypeAgent Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`94[.]154[.]32[.]6:7080`	botnet_cc	2026-08-26	75%
ip:port	`94[.]154[.]32[.]6:7443`	botnet_cc	2026-08-26	75%
ip:port	`64[.]89[.]160[.]77:7080`	botnet_cc	2026-08-26	75%
ip:port	`45[.]85[.]94[.]195:36626`	botnet_cc	2026-08-26	75%
ip:port	`31[.]77[.]248[.]3:7080`	botnet_cc	2026-08-26	75%
ip:port	`192[.]255[.]195[.]141:7443`	botnet_cc	2026-08-26	75%
ip:port	`172[.]245[.]209[.]209:7080`	botnet_cc	2026-08-26	75%
ip:port	`108[.]186[.]112[.]147:7080`	botnet_cc	2026-08-26	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["192.255.195.141", "31.77.248.3", "94.154.32.6", "45.85.94.195", "64.89.160.77", "172.245.209.209", "108.186.112.147"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.255.195.141", "31.77.248.3", "94.154.32.6", "45.85.94.195", "64.89.160.77", "172.245.209.209", "108.186.112.147"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — HypeAgent

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: HypeAgent IOCs detection rule in an enterprise environment:

Scenario: Scheduled Endpoint Protection Updates via WSUS
- Context: The Windows Update Service (via WSUS) or a dedicated patching tool like Microsoft Endpoint Configuration Manager (MECM/SCCM) frequently downloads and installs HypeAgent security definitions. This triggers the detection when the agent’s update service communicates with the central repository, matching the specific IOCs associated with definition files.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (wuauserv.exe or ccmexec.exe) and restrict the alert to only trigger if the source IP is not within the internal WSUS server subnet (e.g., exclude traffic where Source_IP matches the known WSUS range).
Scenario: Automated Backup Jobs by Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize HypeAgent as a pre-filter or integration module during agent-based backups. When the backup job initiates, it spawns processes that load HypeAgent IOCs to scan data streams before archiving, generating legitimate traffic patterns matching the rule’s logic.
- Filter/Exclusion: Implement an exclusion based on Parent Process Name. If the detected process is a child of vrb.exe (Veeam) or simsv.exe (Commvault), suppress the alert. Alternatively, exclude alerts occurring during defined maintenance windows (e.g., 02:00–06:00 local time).
Scenario: Admin-Driven Security Policy Deployment via GPO
- Context: System Administrators frequently push new security policies using **Group Policy Objects (