ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of twenty-seven unknown malware indicators that may signal a novel or evolving threat within the network. Proactive hunting in Azure Sentinel is critical to identify these early-stage infections before they establish persistence, ensuring rapid containment and reducing the risk of lateral movement across cloud assets.

IOC Summary

Malware Family: Unknown malware Total IOCs: 27 IOC Types: ip:port, domain, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`154[.]220[.]94[.]34:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]95[.]110:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]94[.]50:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]94[.]54:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]94[.]58:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]93[.]243:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]93[.]230:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]93[.]236:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]92[.]179:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]92[.]182:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]122[.]126:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]92[.]168:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]122[.]102:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]122[.]124:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]121[.]47:8888`	botnet_cc	2026-07-01	100%
ip:port	`94[.]156[.]179[.]168:7443`	botnet_cc	2026-07-01	75%
ip:port	`185[.]46[.]10[.]210:7443`	botnet_cc	2026-07-01	75%
ip:port	`181[.]225[.]233[.]172:7443`	botnet_cc	2026-07-01	75%
ip:port	`178[.]105[.]68[.]110:7443`	botnet_cc	2026-07-01	75%
ip:port	`154[.]220[.]121[.]38:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]121[.]41:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]120[.]230:8888`	botnet_cc	2026-07-01	100%
ip:port	`154[.]220[.]120[.]246:8888`	botnet_cc	2026-07-01	100%
url	`hxxps://merabs.pro/473f5c82.exe`	payload_delivery	2026-07-01	75%
domain	`pop.topsm188.top`	botnet_cc	2026-07-01	50%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["154.220.94.54", "154.220.92.182", "154.220.120.246", "154.220.122.126", "154.220.92.168", "185.46.10.210", "154.220.93.243", "154.220.93.230", "181.225.233.172", "154.220.95.110", "154.220.94.58", "154.220.92.179", "154.220.121.47", "178.105.68.110", "154.220.94.50", "154.220.93.236", "154.220.122.124", "154.220.121.38", "154.220.121.41", "154.220.120.230", "154.220.94.34", "154.220.122.102", "94.156.179.168"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.220.94.54", "154.220.92.182", "154.220.120.246", "154.220.122.126", "154.220.92.168", "185.46.10.210", "154.220.93.243", "154.220.93.230", "181.225.233.172", "154.220.95.110", "154.220.94.58", "154.220.92.179", "154.220.121.47", "178.105.68.110", "154.220.94.50", "154.220.93.236", "154.220.122.124", "154.220.121.38", "154.220.121.41", "154.220.120.230", "154.220.94.34", "154.220.122.102", "94.156.179.168"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["pop.topsm188.top", "merabs.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://merabs.pro/473f5c82.exe", "https://ardotcharleybuking.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, tailored to an enterprise environment using common security and operational tools:

Scenario 1: Automated Software Deployment via SCCM/Intune
- Context: The IT Operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push a new version of Adobe Acrobat Reader or Java Runtime Environment to the entire “Finance” OU. The deployment script downloads temporary installer files from an internal distribution point that resolves to a generic public IP address not yet whitelisted in the ThreatFox feed, triggering multiple IOCs for network connections and file hashes.
- Filter/Exclusion: Create an exclusion rule based on the Source Process Name (ccmexec.exe or IntuneManagementExtension.exe) and restrict the alert to specific Destination Ports (e.g., 80, 443) originating from known internal distribution server subnets.
Scenario 2: Scheduled Antivirus Definition Updates
- Context: The enterprise endpoint protection solution (e.g., CrowdStrike Falcon or Symantec Endpoint Protection) runs a scheduled job every Tuesday at 02:00 AM to fetch the latest virus definition database from the vendor’s cloud. This process initiates connections to several high-volume, rotating IP addresses used by the vendor’s update servers, which may be flagged as “Unknown” due to their dynamic nature or recent changes in the ThreatFox feed.
- Filter/Exclusion: Implement a time-based filter to suppress alerts between 01:30 and 04:00 for processes matching the specific AV service executable (e.g., C:\Program Files\CrowdStrike\fs.exe) connecting to known vendor domains or IP ranges.
Scenario 3: Backup Agent Data Synchronization