ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hypothesis targets the presence of 11 specific indicators of compromise linked to an unidentified malware strain, which may indicate an active or dormant infection within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate affected assets before the unknown malware can establish persistence or execute lateral movement.

IOC Summary

Malware Family: Unknown malware Total IOCs: 11 IOC Types: ip:port, domain, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["45.92.170.87", "3.6.16.126"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.92.170.87", "3.6.16.126"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["492102.us22.myftpupload.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://177.70.102.228:8070/TmpFTP/Manifesta%C3%A7%C3%A3o/Consulta/18296147000640/2022-04-14/info.zip", "http://177.70.102.228:8070/TmpFTP/Manifesta%C3%A7%C3%A3o/Consulta/02589791000910/2023-10-23/info.zip", "https://pub-4cf232026b854c1e8bb06b595c8f7587.r2.dev/special%20invitation.msi", "https://pub-d21b4190a47f45628c828456f23dd66e.r2.dev/38-146-219-200.msi", "http://136.233.149.66:8001/sshd", "http://103.20.213.34:8080/uploads/uploads/aryacorp%20delhi/info.zip", "http://177.70.102.232:8070/tmpftp/01/recep%C3%A7%C3%A3o/2024-10-30/info.zip", "http://177.70.102.232:8070/tmpftp/01/recep%C3%A7%C3%A3o/2023-10-25/info.zip"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency package from a public repository (e.g., GitHub, PyPI, or an internal Artifactory) that happens to share a hash or URL pattern with one of the 11 IOCs.

  • Filter/Exclusion: Exclude alerts where the source IP is within the internal CIDR range of the development network and the destination port is 443/80, or specifically whitelist known repository domains (e.g., *.github.com, *.pypi.org) in the URL-based IOC checks.

• Scenario: An IT administrator runs a scheduled PowerShell script to update third-party software (e.g., Adobe Reader, Java, or Chrome) that downloads an installer from a vendor’s update server which matches a known IOC hash or URL.

  • Filter/Exclusion: Exclude alerts originating from service accounts (e.g., svc-software-update) or processes running under the SYSTEM account, and whitelist common update endpoints like *.adobe.com, *.java.com, or *.google.com for the relevant IOC types.

• Scenario: A security team performs a vulnerability scan or penetration test using tools like Nessus, Qualys, or Metasploit, which may download small probe files or exploit payloads that match the IOCs.

  • Filter/Exclusion: Exclude alerts where the initiating process is a known scanner binary (e.g., nessus.exe, qualys_agent.exe, msfconsole.exe) or where the user context is a dedicated security test account (e.g., sec-test-user).

• Scenario: A data scientist or analyst uses Python or R to download a dataset or library from a public source (e.g., Kaggle, Hugging Face, or a university server) that matches an IOC URL