ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies unknown malware indicators that adversaries utilize to exfiltrate sensitive data and establish persistent access through compromised credentials or exploited vulnerabilities. The SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify stealthy threats before they can solidify their foothold and execute long-term data theft operations.

IOC Summary

Malware Family: Unknown malware Total IOCs: 11 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["91.236.230.143", "2.27.63.244", "102.117.167.183", "155.117.155.237", "143.110.197.12", "111.170.148.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.236.230.143", "2.27.63.244", "102.117.167.183", "155.117.155.237", "143.110.197.12", "111.170.148.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://cuuwa.ca/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Endpoint Antivirus Definition Updates

  • Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender) frequently download new definition signatures or heuristic models from the cloud. These updates often manifest as new executable files with unknown hashes that trigger network connections to update servers, mimicking the “exfiltration” and “persistence” behavior of the rule.
  • Filter/Exclusion: Exclude traffic originating from specific EDR service accounts (e.g., svc-crowdstrike or NT SERVICE\DefenderSvc) connecting to known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com). Additionally, filter out processes with a known “Update” signature in the file path.

• Scenario: Scheduled Backup and Data Archiving Jobs

  • Context: Legacy backup agents like Veeam or Commvault often run scheduled jobs during off-hours to compress and transfer large datasets to cloud repositories (e.g., AWS S3, Azure Blob). The high-volume data transfer combined with the creation of temporary staging files can be misidentified as a malware exfiltration event.
  • Filter/Exclusion: Create an exclusion for processes running under specific backup service accounts (e.g., VeeamBackupService, CommvaultAgent) during defined maintenance windows (e.g., 02:00–06:00 local time). Filter alerts where the destination IP belongs to the organization’s known cloud storage CIDR blocks.

• Scenario: Software Deployment via Configuration Management Tools

  • Context: IT operations teams use tools like Ansible, Puppet, or SCCM (System Center Configuration Manager) to push