This hunt targets the presence of known Lumma Stealer indicators of compromise, which are frequently deployed to exfiltrate sensitive data such as credentials, browser information, and cryptocurrency wallet contents. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, mitigating the risk of persistent data theft and lateral movement before the adversary achieves their objectives.
Malware Family: Lumma Stealer Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]181[.]181[.]26:80 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 5[.]181[.]181[.]26:443 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 88[.]198[.]29[.]97:443 | botnet_cc | 2026-09-06 | 75% |
| ip:port | 91[.]228[.]52[.]43:443 | botnet_cc | 2026-09-06 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Lumma Stealer
let malicious_ips = dynamic(["5.181.181.26", "88.198.29.97", "91.228.52.43"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.181.181.26", "88.198.29.97", "91.228.52.43"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom PowerShell script to audit application logs, which inadvertently includes a string match for one of the Lumma Stealer hash values or file paths (e.g., C:\Users\Public\luma.exe) as a placeholder or comment in the script source.
powershell.exe or pwsh.exe and the command line contains specific audit keywords like -Audit, -LogReview, or -Test-Path, or exclude paths under C:\Scripts\ or C:\DevOps\ if the IOC is a file path.Scenario: An IT administrator runs a known vulnerability scanner (e.g., Tenable Nessus or Qualys) that creates temporary files in the %TEMP% directory using a naming convention that matches one of the Lumma Stealer IOCs (e.g., tmp_luma_scan.dat) during a scheduled Tuesday night maintenance window.
nessus.exe, qualys_agent.exe) or where the file path contains Nessus, Qualys, or VulnerabilityScan, and the creation time aligns with the documented maintenance window (e.g., 02:00–04:00 AM).Scenario: A QA engineer tests a new internal build of a legacy application that uses a shared library or resource file named lumma.dll or luma_core.sys (a common naming convention for “Luma” branding in the company’s product suite) during manual regression testing on a non-production test VM.
*TEST*, *QA*, `