ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the presence of twelve distinct indicators of compromise (IOCs) linked to unknown malware families that may evade standard signature-based detection. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage infections and establish baseline telemetry before the malware executes lateral movement or data exfiltration within the cloud environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 12 IOC Types: ip:port, url, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["159.195.193.179"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.195.193.179"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["bonavol.pro", "lumennix.top", "funrat.co", "bestcheats.online", "figural.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://thespeedyhomeoffer.com/", "https://hollytree-transport.co.uk/", "https://emdgroupe.com/", "https://cgain.net/", "https://purplebandage.org.za/", "https://www.rssssociety.org.in/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Updates via SCCM/Intune

  • Scenario: The IT Operations team deploys a new definition update or heuristic engine patch to 500+ workstations using Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune. This process generates temporary network connections and file hashes that match the “Unknown” IOCs in the ThreatFox feed before the local AV engines fully index them, triggering alerts on the distribution points and client agents.
  • Filter/Exclusion: Exclude traffic originating from the specific IP ranges of SCCM Distribution Points and Intune Management Service endpoints. Additionally, add a time-based filter to suppress alerts during scheduled maintenance windows (e.g., 02:00–04:00 UTC) when these updates are pushed.

• Automated Software Deployment via Ansible/Terraform

  • Scenario: A DevOps engineer executes an automated infrastructure-as-code pipeline using Ansible to deploy a new internal utility tool across the development cluster. The deployment script downloads binaries from an internal artifact repository (e.g., JFrog Artifactory) and extracts them, creating file artifacts that match the generic “Unknown malware” signatures in the ThreatFox package before they are whitelisted by the local EDR agent.
  • Filter/Exclusion: Create a rule to exclude IOCs associated with the internal artifact repository domain (e.g., artifacts.internal.corp) and specific file paths where deployment scripts execute (e.g., /tmp/deploy_staging/* or C:\ProgramData\Ansible\).

• Scheduled Backup Jobs using Veeam or Commvault

  • Scenario: Nightly backup jobs run by Veeam Backup & Replication initiate a full