ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating network and endpoint telemetry against a curated set of 19 emerging Indicators of Compromise (IOCs) from ThreatFox. Proactively hunting for these signals in Azure Sentinel is critical to uncover stealthy threats that evade signature-based defenses, enabling the SOC team to isolate compromised assets before lateral movement occurs.

IOC Summary

Malware Family: Unknown malware Total IOCs: 19 IOC Types: domain, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`54[.]54[.]27[.]128:443`	botnet_cc	2026-08-13	75%
ip:port	`185[.]199[.]197[.]93:7443`	botnet_cc	2026-08-13	75%
ip:port	`139[.]180[.]136[.]200:7443`	botnet_cc	2026-08-13	75%
url	`hxxps://validationreq.top/i-MXpmecIOMmvf/`	payload_delivery	2026-08-13	90%
domain	`trainingforwarriors.com`	payload_delivery	2026-08-13	75%
ip:port	`139[.]196[.]231[.]194:80`	botnet_cc	2026-08-13	100%
url	`hxxps://bc1collection.com/`	payload_delivery	2026-08-13	90%
ip:port	`139[.]196[.]231[.]194:8080`	botnet_cc	2026-08-13	100%
ip:port	`139[.]196[.]231[.]194:60000`	botnet_cc	2026-08-13	100%
ip:port	`139[.]196[.]231[.]194:443`	botnet_cc	2026-08-13	100%
ip:port	`156[.]239[.]47[.]245:8888`	botnet_cc	2026-08-13	100%
ip:port	`139[.]196[.]231[.]194:22`	botnet_cc	2026-08-13	100%
ip:port	`156[.]239[.]47[.]245:443`	botnet_cc	2026-08-13	100%
ip:port	`198[.]199[.]86[.]166:7443`	botnet_cc	2026-08-13	100%
domain	`crownoasis.org`	payload_delivery	2026-08-13	75%
domain	`mpe2000.info`	payload_delivery	2026-08-13	75%
url	`hxxp://185[.]93[.]89[.]72/wget`	payload_delivery	2026-08-13	100%
domain	`piji.com.au`	payload_delivery	2026-08-13	75%
ip:port	`156[.]239[.]47[.]245:22`	botnet_cc	2026-08-13	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["54.54.27.128", "185.199.197.93", "198.199.86.166", "139.196.231.194", "139.180.136.200", "156.239.47.245"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["54.54.27.128", "185.199.197.93", "198.199.86.166", "139.196.231.194", "139.180.136.200", "156.239.47.245"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["trainingforwarriors.com", "crownoasis.org", "mpe2000.info", "piji.com.au"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://validationreq.top/i-MXpmecIOMmvf/", "https://bc1collection.com/", "http://185.93.89.72/wget"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Security Scanning by Endpoint Protection Agents
- Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently generate new hashes or network connections during their scheduled “Deep Scan” cycles. These scans often trigger the creation of temporary files and network sessions that match generic IOCs flagged as “Unknown” by ThreatFox before they are fully whitelisted in the central threat intelligence platform.
- Filter/Exclusion: Create a rule exclusion for processes matching C:\Program Files\Microsoft Defender\MsMpEng.exe or C:\ProgramData\CrowdStrike\FalconSensor\csfalcon.exe. Additionally, exclude network traffic originating from internal IP ranges designated as “Security Management” (e.g., 10.50.20.0/24) during the scheduled maintenance window (02:00 – 04:00 UTC).
Scenario: Software Deployment via Configuration Management Tools
- Context: When IT operations deploy new applications or patches using tools like Microsoft System Center Configuration Manager (SCCM) or Ansible, the deployment agents often download installer packages from internal repositories. These installers may contain new executable hashes that have not yet been ingested into ThreatFox’s known-good database, triggering an “Unknown Malware” alert for every deployed workstation.
- Filter/Exclusion: Implement a filter to exclude IOCs where the source process is ccmsetup.exe (SCCM) or ansible-runner. Furthermore, add a logic condition to suppress alerts if the file hash matches entries in the internal “Approved Software Catalog” database within 24 hours of the first