ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection identifies potential unknown malware threats by correlating four specific indicators of compromise that may evade signature-based defenses. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover stealthy adversary activity before it escalates into a confirmed incident, ensuring rapid containment and reducing dwell time.

IOC Summary

Malware Family: Unknown malware Total IOCs: 4 IOC Types: domain, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]192[.]105[.]141:19000`	botnet_cc	2026-09-01	100%
ip:port	`5[.]89[.]184[.]173:443`	botnet_cc	2026-09-01	50%
domain	`ifuqpatr.com`	botnet_cc	2026-09-01	75%
ip:port	`64[.]89[.]163[.]22:9000`	botnet_cc	2026-09-01	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["5.89.184.173", "64.89.163.22", "45.192.105.141"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.89.184.173", "64.89.163.22", "45.192.105.141"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["ifuqpatr.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs rule in an enterprise environment:

Scenario: Antivirus Vendor Signature Updates
- Context: Major security vendors (e.g., CrowdStrike, Microsoft Defender, SentinelOne) frequently push new signature definitions or heuristic updates that include IOCs not yet cataloged in the ThreatFox threat intelligence feed. These updates often trigger alerts for “unknown” hashes or file paths during the initial rollout window.
- Filter/Exclusion: Exclude processes and network connections originating from known AV service executables (e.g., C:\Program Files\CrowdStrike\fsutil.exe, C:\Windows\System32\DefenderSvc.exe) and restrict alerts to business hours or specific maintenance windows when updates are typically deployed.
Scenario: Scheduled Software Deployment via SCCM/Intune
- Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often push new applications or patches containing executable files with hashes that have not yet been ingested into the ThreatFox database. These deployments generate high-volume IOCs during scheduled maintenance windows, mimicking unknown malware behavior.
- Filter/Exclusion: Create a whitelist for processes launched by deployment agents (e.g., ccmsetup.exe, Microsoft.IntuneManagementAgent) and exclude any IOC matches occurring on endpoints tagged with the “Deployment” group during the defined update cycle (e.g., Tuesday 02:00 – 06:00 UTC).
Scenario: Internal Development Build Artifacts
- Context: In R&D or DevOps environments, developers frequently compile and test internal builds using tools like Jenkins, GitLab CI, or Azure DevOps. These custom binaries often possess unique hashes that do not exist in public threat intelligence feeds, leading to false alerts when