ThreatFox: HypeAgent IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of HypeAgent indicators to establish persistence or execute malicious payloads within the Azure environment. A SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly identify and contain early-stage compromises before they escalate into broader lateral movement incidents.

IOC Summary

Malware Family: HypeAgent Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`80[.]76[.]49[.]47:7443`	botnet_cc	2026-08-25	75%
ip:port	`66[.]235[.]175[.]82:7080`	botnet_cc	2026-08-25	75%
ip:port	`31[.]77[.]248[.]3:7443`	botnet_cc	2026-08-25	75%
ip:port	`195[.]177[.]94[.]155:7443`	botnet_cc	2026-08-25	75%
ip:port	`151[.]241[.]154[.]55:7443`	botnet_cc	2026-08-25	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - HypeAgent
let malicious_ips = dynamic(["80.76.49.47", "31.77.248.3", "195.177.94.155", "151.241.154.55", "66.235.175.82"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["80.76.49.47", "31.77.248.3", "195.177.94.155", "151.241.154.55", "66.235.175.82"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — HypeAgent

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: HypeAgent IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patch Deployment via SCCM/Intune
- Context: The endpoint management system (e.g., Microsoft Endpoint Configuration Manager or Intune) automatically pushes a security update to the HypeAgent service during business hours. This triggers the rule as the agent processes new IOCs and updates its local definition database, mimicking an active threat scan.
- Filter/Exclusion: Exclude events where the ProcessName matches ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe AND the ParentProcessName is a known system service account (e.g., SYSTEM). Alternatively, create a time-based exclusion for maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Scheduled Antivirus Definition Sync
- Context: A scheduled task runs nightly to synchronize HypeAgent’s threat intelligence feed. The agent downloads and ingests a batch of new IOCs from the central ThreatFox server, causing high-volume network activity and file I/O that triggers the detection logic for “new IOC association.”
- Filter/Exclusion: Filter out alerts where the SourceIP belongs to the internal ThreatFox distribution subnet (e.g., 10.20.x.x) AND the event type is specifically a “Definition Update” rather than an “Active Alert.” Add a rule exclusion for the specific scheduled task name: \Microsoft\HypeAgent\ScheduledSync.
Scenario: Onboarding of New Workstations
- Context: During IT onboarding, new laptops are joined to the domain and immediately provisioned with the HypeAgent client. The initial installation