The ThreatFox: DanaBot IOCs rule detects potential command and control communication associated with the DanaBot malware, indicating possible compromise of endpoints. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced persistent threats leveraging DanaBot’s infrastructure.
IOC Summary
Malware Family: DanaBot Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 44[.]211[.]251[.]197:8082 | botnet_cc | 2026-05-18 | 75% |
| ip:port | 34[.]230[.]7[.]122:8082 | botnet_cc | 2026-05-18 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["34.230.7.122", "44.211.251.197"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["34.230.7.122", "44.211.251.197"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: Legitimate system update using msiexec.exe
Filter/Exclusion: process.name == msiexec.exe and process.args contains "update" or process.args contains "install"
Scenario: Scheduled job running schtasks.exe to perform routine maintenance
Filter/Exclusion: process.name == schtasks.exe and process.args contains "/create" or process.args contains "/run"
Scenario: Admin using PowerShell.exe to run a script for log cleanup
Filter/Exclusion: process.name == PowerShell.exe and process.args contains "Cleanup-Log.ps1" or process.args contains "Clear-EventLog"
Scenario: Legitimate use of curl.exe or wget.exe for downloading software updates
Filter/Exclusion: process.name in (curl.exe, wget.exe) and process.args contains "update" or process.args contains "software"
Scenario: System command-line tool taskkill.exe used to terminate a non-malicious process
Filter/Exclusion: process.name == taskkill.exe and process.args contains "/F /PID" and process.args contains "known_service"