ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of twenty-five distinct indicators of compromise (IOCs) linked to previously unidentified malware strains within the Azure Sentinel environment. A SOC team should proactively hunt for these unknown threats to rapidly identify and contain emerging malicious activity before it escalates into a broader incident, leveraging high-severity alerts to prioritize immediate investigation.

IOC Summary

Malware Family: Unknown malware Total IOCs: 25 IOC Types: ip:port, domain, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`111[.]228[.]13[.]59:18443`	botnet_cc	2026-08-15	75%
ip:port	`104[.]194[.]132[.]192:24432`	botnet_cc	2026-08-15	75%
ip:port	`111[.]170[.]148[.]132:19000`	botnet_cc	2026-08-15	100%
ip:port	`111[.]170[.]148[.]132:8082`	botnet_cc	2026-08-15	100%
ip:port	`111[.]170[.]148[.]132:1080`	botnet_cc	2026-08-15	100%
ip:port	`93[.]95[.]227[.]51:7443`	botnet_cc	2026-08-15	100%
url	`hxxps://flexsportpools.com/`	payload_delivery	2026-08-15	90%
domain	`nickanto.info`	payload_delivery	2026-08-15	90%
domain	`mvb.rs`	payload_delivery	2026-08-15	90%
url	`hxxps://blaze-x.com/`	payload_delivery	2026-08-15	90%
domain	`flexsportpools.com`	payload_delivery	2026-08-15	90%
domain	`desarrollosoftware.top`	payload_delivery	2026-08-15	90%
domain	`blaze-x.com`	payload_delivery	2026-08-15	90%
domain	`cantieregroup.rs`	payload_delivery	2026-08-15	90%
ip:port	`198[.]199[.]74[.]231:443`	botnet_cc	2026-08-14	75%
ip:port	`102[.]117[.]165[.]168:7443`	botnet_cc	2026-08-14	75%
ip:port	`45[.]66[.]248[.]156:7443`	botnet_cc	2026-08-14	100%
ip:port	`43[.]143[.]118[.]200:8084`	botnet_cc	2026-08-14	100%
ip:port	`43[.]143[.]118[.]200:8443`	botnet_cc	2026-08-14	100%
ip:port	`111[.]170[.]148[.]132:60000`	botnet_cc	2026-08-14	100%
url	`hxxps://vuaketdinh.com/`	payload_delivery	2026-08-14	90%
ip:port	`111[.]170[.]148[.]132:8888`	botnet_cc	2026-08-14	100%
ip:port	`111[.]170[.]148[.]132:8080`	botnet_cc	2026-08-14	100%
ip:port	`111[.]170[.]148[.]132:443`	botnet_cc	2026-08-14	100%
ip:port	`111[.]170[.]148[.]132:80`	botnet_cc	2026-08-14	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["102.117.165.168", "93.95.227.51", "43.143.118.200", "45.66.248.156", "111.170.148.132", "104.194.132.192", "111.228.13.59", "198.199.74.231"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.117.165.168", "93.95.227.51", "43.143.118.200", "45.66.248.156", "111.170.148.132", "104.194.132.192", "111.228.13.59", "198.199.74.231"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["nickanto.info", "mvb.rs", "flexsportpools.com", "desarrollosoftware.top", "blaze-x.com", "cantieregroup.rs"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://flexsportpools.com/", "https://blaze-x.com/", "https://vuaketdinh.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise endpoints (e.g., Windows 10/11) running Microsoft Defender or Symantec Endpoint Protection automatically download new definition packs via scheduled tasks at night. These updates often introduce new hashes and file paths that the ThreatFox engine has not yet indexed as “known,” triggering a hit on the 25 IOCs.
- Filter/Exclusion: Create an exclusion rule based on the specific Process Name (MpCmdRun.exe for Defender or Symantec Antivirus Client) and restrict detection to business hours (e.g., exclude events occurring between 01:00 and 05:00 local time). Alternatively, add the update server IP ranges (e.g., Microsoft Update CDN IPs) to a trusted whitelist.
Scenario: Patch Management Deployment via SCCM/Intune
- Context: During monthly maintenance windows, Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune pushes cumulative updates and application patches to thousands of machines. The installation process generates temporary files and executable scripts with new hashes that match the “Unknown malware” profile before being fully cataloged in ThreatFox.
- Filter/Exclusion: Implement a filter excluding events where the Parent Process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe. Additionally, exclude file paths containing standard deployment directories such as %ProgramData%\Microsoft\Intune Management Extension\ or \Windows\CCM\Logs\.
Scenario: Automated Backup and Archiving Jobs
- Context: Enterprise backup solutions like **Veeam Backup