ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware threats by monitoring five specific Indicators of Compromise (IOCs) that may signal early-stage adversary activity within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly isolate and investigate novel malicious artifacts before they can establish persistence or propagate across the environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 5 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://193-233-126-53.sslip.io/d3f8a142c9/verification.sct`	payload_delivery	2026-08-21	90%
url	`hxxps://www.rzrms.com/`	payload_delivery	2026-08-21	90%
url	`hxxps://www.tdvm4q.com/`	payload_delivery	2026-08-21	90%
domain	`akmuniverstall.top`	botnet_cc	2026-08-21	100%
url	`hxxps://akmuniverstall.top/backend/api/app.php`	botnet_cc	2026-08-21	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["akmuniverstall.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://193-233-126-53.sslip.io/d3f8a142c9/verification.sct", "https://www.rzrms.com/", "https://www.tdvm4q.com/", "https://akmuniverstall.top/backend/api/app.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, along with targeted filters and exclusions:

Scenario: Security Tool Self-Generated Hashes
- Context: Enterprise endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently generate unique process hashes or network connection signatures during their own update cycles or telemetry uploads that do not yet exist in the global ThreatFox IOC database.
- Filter/Exclusion: Exclude IOCs where the source process path matches known security agent directories (e.g., C:\Program Files\CrowdStrike\ or C:\Windows\System32\defender.exe) and the action is “Telemetry Upload” or “Signature Update.”
Scenario: Scheduled Administrative Deployment Jobs
- Context: Automated deployment tools like Microsoft SCCM (Configuration Manager) or Ansible Tower push new application binaries to endpoints during maintenance windows. These newly deployed executables often have fresh hashes that trigger the rule before they are ingested into the IOC feed.
- Filter/Exclusion: Create a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC on weekdays, specifically filtering out processes spawned by ccmexec.exe (SCCM) or ansible-runner where the file age is less than 24 hours.
Scenario: Developer Build Artifacts in CI/CD Pipelines
- Context: Internal DevOps teams using Jenkins or Azure DevOps Agents frequently compile and test new build artifacts on shared jump servers. These temporary binaries are often unique to the specific sprint and lack global IOC coverage, causing high-volume noise during active development sprints.
- Filter/Exclusion: Exclude alerts originating from IP ranges dedicated to