ThreatFox: DanaBot IOCs

Hunt Hypothesis

This detection rule identifies adversary activity consistent with the DanaBot malware by monitoring for specific Indicators of Compromise (IOCs) known to facilitate command-and-control communication and lateral movement. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification allows the SOC team to isolate infected endpoints before the botnet can expand its reach or exfiltrate sensitive data across the cloud environment.

IOC Summary

Malware Family: DanaBot Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DanaBot
let malicious_ips = dynamic(["177.22.119.145", "109.227.35.147"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["177.22.119.145", "109.227.35.147"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DanaBot

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: DanaBot IOCs detection rule in an enterprise environment, along with targeted filters or exclusions:

• Security Team Manual Threat Hunting

  • Scenario: Security analysts manually running threat intelligence tools (e.g., CrowdStrike Falcon, Tenable Nessus, or Microsoft Defender for Endpoint) to scan the network against known DanaBot indicators. These scans often generate process executions and network connections that match the exact IOCs defined in the rule, mimicking an active infection rather than a detection engine check.
  • Filter/Exclusion: Exclude traffic originating from specific Security Operations Center (SOC) workstations or jump servers where threat hunting tools are installed. Additionally, filter out events where the parent process is a known security scanner executable (e.g., falcon-sensor.exe, TenableAgent.exe) rather than a standard user application like chrome.exe or outlook.exe.

• Scheduled Antivirus Definition Updates

  • Scenario: Enterprise endpoint protection suites (such as Symantec Endpoint Protection, McAfee ePO, or Sophos Central) performing scheduled daily updates. During these updates, the AV engine downloads and validates new signature databases which may include DanaBot IOCs. The verification process triggers file integrity checks and network lookups that align with the detection logic, appearing as a legitimate threat match.
  • Filter/Exclusion: Create an exclusion for events occurring during standard maintenance windows (e.g., 02:00–04:00 local time) where the initiating process is the antivirus service itself (e.g., Symantec AntiVirus.exe, McAfee VirusScan Service). Correlate these with successful “Update Completed” logs from the management console to suppress alerts.

• **IT Admin Deployment of Patched