This hunt targets known indicators of compromise associated with the Prometei threat actor to identify potential lateral movement or persistence mechanisms within the environment. Proactively hunting for these IOCs allows the SOC to detect early-stage intrusion activity and isolate affected assets before the adversary can establish a foothold or escalate privileges.
Malware Family: Prometei Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 081358e7d4586ef57208d63dfa194b97 | payload | 2026-09-13 | 95% |
| sha256_hash | 7b1a084f020776a1b1b701b009e659be46aa6f7b7dacab92fdc5b13fe260fb2b | payload | 2026-09-13 | 95% |
| sha1_hash | 9cb1c1f41edf5def51ed1c18835d68722d057932 | payload | 2026-09-13 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Prometei
let malicious_hashes = dynamic(["081358e7d4586ef57208d63dfa194b97", "7b1a084f020776a1b1b701b009e659be46aa6f7b7dacab92fdc5b13fe260fb2b", "9cb1c1f41edf5def51ed1c18835d68722d057932"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitLab CI) to deploy a new version of a microservice that includes a shared library or dependency package matching one of the Prometei IOCs (e.g., a specific hash or URL pattern). The deployment script downloads the artifact from an internal artifact repository (like Nexus or Artifactory) that mirrors the external source, triggering the IOC match on the download or execution event.
10.20.0.0/16) AND the process is a known build agent executable (e.g., java.exe, node.exe, or jenkins-agent.exe).Scenario: An IT administrator performs a routine patching cycle using a tool like SCCM or Ansible to update a specific application (e.g., a Java-based web app) across multiple servers. The update package contains a JAR file or binary that shares a cryptographic hash with one of the Prometei IOCs due to a common open-source dependency being bundled in the installer.
ccmexec.exe, ansible-playbook.exe, or wsus) AND the event type is “File Created” or “Process Started” with a path under standard application directories (e.g., C:\Program Files\ or /opt/app/).Scenario: A security team runs a threat hunting simulation or a red team exercise that intentionally deploys a canary token or a lightweight agent matching one of the Prometei IOCs to test detection coverage. The agent is deployed via a scheduled task or PowerShell script on a designated test host.