ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating nine distinct indicators of compromise that may evade traditional signature-based defenses. A proactive hunt is essential in Azure Sentinel to rapidly isolate these emerging threats before they establish persistence or exfiltrate sensitive data within the cloud environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 9 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]158[.]116[.]86:7443`	botnet_cc	2026-09-02	75%
ip:port	`43[.]133[.]164[.]200:9090`	botnet_cc	2026-09-02	75%
ip:port	`189[.]141[.]23[.]165:7443`	botnet_cc	2026-09-02	75%
ip:port	`124[.]198[.]132[.]172:443`	botnet_cc	2026-09-02	50%
ip:port	`94[.]154[.]32[.]34:443`	botnet_cc	2026-09-02	50%
ip:port	`84[.]54[.]33[.]208:443`	botnet_cc	2026-09-02	50%
ip:port	`77[.]83[.]39[.]20:443`	botnet_cc	2026-09-02	50%
ip:port	`45[.]148[.]10[.]133:443`	botnet_cc	2026-09-02	50%
ip:port	`152[.]136[.]56[.]105:80`	botnet_cc	2026-09-02	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["124.198.132.172", "152.136.56.105", "94.154.32.34", "84.54.33.208", "45.158.116.86", "77.83.39.20", "43.133.164.200", "45.148.10.133", "189.141.23.165"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.198.132.172", "152.136.56.105", "94.154.32.34", "84.54.33.208", "45.158.116.86", "77.83.39.20", "43.133.164.200", "45.148.10.133", "189.141.23.165"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Security Scans by Endpoint Protection Agents
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently perform scheduled “Deep Scan” or “On-Demand Scan” tasks. These agents often generate temporary IOCs (file hashes, network connections to update servers) that the ThreatFox engine may not yet recognize as benign, triggering an alert on unknown malware signatures.
- Filter/Exclusion: Create a rule exclusion based on the process name and parent process. Exclude alerts where ProcessName matches known EDR agents (e.g., FalconSensor.exe, MsMpEng.exe) and ParentProcessName is the system scheduler (TaskHostW.exe or svchost.exe). Additionally, exclude network connections to known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com).
Scenario: Software Deployment via Configuration Management Tools
- Context: IT operations teams use tools like Microsoft SCCM, Jamf, or Ansible to push software updates or patches. During these deployments, the tools download new executables and scripts from internal repositories that may not be in the ThreatFox “Known Good” database yet, causing them to appear as unknown malware IOCs.
- Filter/Exclusion: Implement a filter based on User Context and Source IP. Exclude alerts where the UserName belongs to the IT-Operations or Service-Accounts group (e.g., svc_sccm, admin_jamf) and the source IP falls within the internal management subnet range (e.g., `10.20