This hunt detects adversary activity by correlating Azure Sentinel logs against ten specific Indicators of Compromise (IOCs) linked to the HypeAgent threat actor. Proactive hunting for these IOCs is essential to identify early-stage compromises and mitigate potential lateral movement before the adversary establishes a persistent foothold within the environment.
Malware Family: HypeAgent Total IOCs: 10 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 198[.]23[.]177[.]210:7443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 155[.]117[.]183[.]31:7080 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 66[.]55[.]77[.]158:7400 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 172[.]245[.]155[.]83:7443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 94[.]26[.]3[.]112:7443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 94[.]26[.]3[.]112:7080 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 198[.]23[.]177[.]206:7080 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 198[.]23[.]177[.]206:7443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 46[.]151[.]182[.]98:7443 | botnet_cc | 2026-08-27 | 75% |
| ip:port | 196[.]251[.]121[.]137:7080 | botnet_cc | 2026-08-27 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["94.26.3.112", "196.251.121.137", "198.23.177.210", "66.55.77.158", "198.23.177.206", "46.151.182.98", "155.117.183.31", "172.245.155.83"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.26.3.112", "196.251.121.137", "198.23.177.210", "66.55.77.158", "198.23.177.206", "46.151.182.98", "155.117.183.31", "172.245.155.83"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: HypeAgent IOCs detection rule in an enterprise environment:
Endpoint Protection Policy Deployment via Group Policy
HypeAgent service on thousands of machines simultaneously as it synchronizes with the central server, generating IOCs that mimic an active threat scan.NT AUTHORITY\SYSTEM) and the initiating process is ccmexec.exe or gpupdate.exe. Additionally, filter out alerts occurring within 15 minutes of scheduled maintenance windows defined in the IT calendar.Scheduled Antivirus Definition Updates
EventTime field, suppressing alerts generated between 01:30 AM and 03:30 AM on weekdays (Monday–Friday). Alternatively, filter by the specific hash of the update installer executable if it is static across the fleet.Patch Management Execution