This detection rule identifies adversary activity by matching network and endpoint logs against known Indicators of Compromise (IOCs) specific to the HypeAgent threat actor within Azure Sentinel. Proactively hunting for these IOCs is critical because early identification of HypeAgent’s unique signatures allows the SOC team to rapidly isolate affected assets and mitigate potential lateral movement before broader compromise occurs.
Malware Family: HypeAgent Total IOCs: 18 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 95[.]164[.]123[.]132:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 45[.]141[.]215[.]40:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 217[.]217[.]97[.]125:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 147[.]124[.]221[.]0:62020 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 95[.]164[.]123[.]132:53105 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 95[.]164[.]123[.]132:56545 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 95[.]164[.]123[.]132:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]92[.]47[.]94:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]92[.]47[.]94:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]124[.]98[.]25:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 91[.]124[.]98[.]25:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 45[.]141[.]215[.]40:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 217[.]217[.]97[.]125:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 213[.]152[.]186[.]188:32605 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 213[.]152[.]186[.]188:32635 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 192[.]109[.]139[.]69:7443 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 192[.]109[.]139[.]69:7080 | botnet_cc | 2026-08-20 | 75% |
| ip:port | 104[.]168[.]70[.]163:7080 | botnet_cc | 2026-08-20 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["104.168.70.163", "192.109.139.69", "217.217.97.125", "91.92.47.94", "45.141.215.40", "213.152.186.188", "147.124.221.0", "91.124.98.25", "95.164.123.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.168.70.163", "192.109.139.69", "217.217.97.125", "91.92.47.94", "45.141.215.40", "213.152.186.188", "147.124.221.0", "91.124.98.25", "95.164.123.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: HypeAgent IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Endpoint Protection Policy Deployment via Intune/SCCM
Source User is a member of the IT-Admins group AND the Process Name matches ccmexec.exe (SCCM) or IntuneManagementExtension.exe.Scheduled Health Check by Centralized Monitoring System
Event Time BETWEEN '02:00' AND '04:00') OR exclude traffic originating from the specific IP address of the monitoring server (Source IP = 192.168.10.55).Automated Backup Routine by Veeam or Commvault