This hunt targets adversary behavior involving the execution of unknown malware by correlating Azure Sentinel logs against a curated set of 24 ThreatFox indicators of compromise (IOCs). Proactively hunting for these IOCs is critical to identify early-stage infections that may bypass standard signature-based defenses, ensuring rapid containment before lateral movement occurs.
Malware Family: Unknown malware Total IOCs: 24 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 166[.]1[.]60[.]161:9090 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 194[.]190[.]152[.]35:9090 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 194[.]226[.]121[.]96:9090 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 192[.]145[.]30[.]230:8080 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 45[.]10[.]164[.]23:9090 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 176[.]65[.]139[.]120:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 194[.]61[.]121[.]154:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 45[.]156[.]27[.]243:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 185[.]241[.]208[.]52:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 45[.]154[.]98[.]125:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 169[.]40[.]135[.]108:10213 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 141[.]98[.]10[.]141:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 169[.]40[.]135[.]108:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 217[.]60[.]195[.]22:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 31[.]57[.]184[.]162:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 45[.]156[.]87[.]174:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 62[.]60[.]226[.]111:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 80[.]94[.]92[.]73:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 91[.]92[.]42[.]236:6969 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 93[.]152[.]221[.]240:6969 | botnet_cc | 2026-07-14 | 100% |
| domain | marjdl.pro | payload_delivery | 2026-07-14 | 100% |
| ip:port | 47[.]94[.]13[.]0:8080 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 47[.]94[.]13[.]0:80 | botnet_cc | 2026-07-14 | 100% |
| ip:port | 47[.]94[.]13[.]0:443 | botnet_cc | 2026-07-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["141.98.10.141", "91.92.42.236", "93.152.221.240", "217.60.195.22", "45.10.164.23", "45.154.98.125", "192.145.30.230", "47.94.13.0", "185.241.208.52", "176.65.139.120", "169.40.135.108", "194.61.121.154", "80.94.92.73", "31.57.184.162", "45.156.27.243", "194.190.152.35", "62.60.226.111", "45.156.87.174", "166.1.60.161", "194.226.121.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["141.98.10.141", "91.92.42.236", "93.152.221.240", "217.60.195.22", "45.10.164.23", "45.154.98.125", "192.145.30.230", "47.94.13.0", "185.241.208.52", "176.65.139.120", "169.40.135.108", "194.61.121.154", "80.94.92.73", "31.57.184.162", "45.156.27.243", "194.190.152.35", "62.60.226.111", "45.156.87.174", "166.1.60.161", "194.226.121.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["marjdl.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, tailored for an enterprise environment:
Automated Software Deployment via SCCM/Intune
ccmexec.exe, Microsoft.IntuneManagementExtension) and exclude traffic originating from the internal artifact repository IP ranges (e.g., 10.x.x.x or specific private subnets) during standard maintenance windows.Scheduled Backup Operations with Cloud Replication
VeeamAgent.exe, CommServe.exe) between 02:00 and 06:00 local time, or exclude IOCs matching the known CIDR blocks of major cloud storage providers if the rule logic allows network destination filtering.Development Build Pipelines (CI/CD)