This hunt targets the presence of Vjw0rm-specific indicators of compromise, which are associated with a high-severity threat known for deploying web shells and establishing persistent access. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the adversary from leveraging the Vjw0rm framework to execute further lateral movement or data exfiltration within the environment.
Malware Family: Vjw0rm Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]246[.]6[.]66:32722 | botnet_cc | 2026-09-02 | 100% |
| ip:port | 46[.]246[.]6[.]66:7044 | botnet_cc | 2026-09-02 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Vjw0rm
let malicious_ips = dynamic(["46.246.6.66"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.246.6.66"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a containerized microservice that includes a debug utility or lightweight agent (e.g., netcat, socat, or a custom Go binary) which matches the Vjw0rm hash or network beaconing pattern during initial health checks.
docker, containerd, crio) or where the parent process is a CI/CD agent (e.g., jenkins-agent, gitlab-runner). Additionally, whitelist the specific container image digest or Kubernetes namespace if the IOCs are known to be embedded in the build artifact.Scenario: An IT administrator performs a manual network connectivity test using a tool like nmap or ping against a staging server that has been temporarily configured with a Vjw0rm-derived payload for penetration testing or vulnerability validation, triggering the IOCs in the production monitoring scope.
staging, dev, or pen-test in the CMDB or asset inventory. Alternatively, create a time-based exclusion window during scheduled maintenance or testing periods, or filter by the specific user account (e.g., svc-pentest, admin-staging) if the activity is performed by a known service account.Scenario: A backup or log aggregation agent (e.g., rsync, logstash, or filebeat) transfers a log file or configuration snippet that contains the Vjw0rm IOC string (e.g., a known URL, IP, or hash) as part of its content, causing a file-based or network-based IOC match when the data is ingested into the SIEM or scanned by EDR