ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hypothesis targets the presence of seven known indicators of compromise associated with unidentified malware strains, which may indicate an active or dormant infection within the environment. Proactively hunting for these IOCs allows the SOC team to identify and isolate compromised assets before the unknown malware can establish persistence or propagate laterally across the Azure Sentinel infrastructure.

IOC Summary

Malware Family: Unknown malware Total IOCs: 7 IOC Types: url, domain, sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["154.36.165.171", "194.48.250.220", "194.238.57.199"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.36.165.171", "194.48.250.220", "194.238.57.199"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["mariadelivery.it", "cloudyrobots.online"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://check-access.info/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["c4f1f3afd7caf474594f7ef511745b9de4a1e72f624c7f73a372b05b25744c62"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A network administrator uses a standard tool like nmap or Advanced IP Scanner to perform routine vulnerability scanning or asset discovery, which generates connection attempts or DNS queries matching the “Unknown” IOCs (e.g., specific IP ranges or domains used for service discovery).
  • Filter/Exclusion: Exclude source IPs belonging to the NetOps or SecurityTeam OU, or filter out events where the source process is nmap.exe, ipscan.exe, or masscan.exe.
• Scenario: An IT support technician runs a remote management tool such as PSTools (PsExec) or RDP to troubleshoot a user’s workstation, resulting in outbound connections to internal management servers or external update servers that match the IOCs (e.g., specific TCP ports or domain names).
  • Filter/Exclusion: Exclude events where the source process is PsExec.exe, mstsc.exe, or wmic.exe, or filter out connections to known internal management subnets (e.g., 10.20.0.0/16).
• Scenario: A scheduled task for software updates (e.g., Windows Update or WSUS client) contacts external update servers or telemetry endpoints that overlap with the “Unknown” IOCs (e.g., specific domains like *.update.microsoft.com or IP ranges associated with CDN providers).
  • Filter/Exclusion: Exclude events where the source process is svchost.exe (specifically the WUA service) or wuauclt.exe, or filter out DNS queries to known Microsoft update domains.
• Scenario: A developer or QA engineer runs a local test environment or containerized application (e.g., Docker, Kubernetes) that makes outbound API calls to third-party services or test endpoints matching the IO