This hypothesis targets the presence of six specific IOCs linked to an unknown malware strain, indicating a potential active compromise or reconnaissance activity within the environment. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate affected assets before the adversary can establish persistence or execute further malicious actions.
Malware Family: Unknown malware Total IOCs: 6 IOC Types: ip:port, url, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 167[.]233[.]243[.]9:7443 | botnet_cc | 2026-09-13 | 75% |
| url | hxxps://mail.leciano.ch/ | payload_delivery | 2026-09-13 | 90% |
| domain | mail.leciano.ch | payload_delivery | 2026-09-13 | 90% |
| domain | holopolsglobal.cc | payload_delivery | 2026-09-13 | 90% |
| ip:port | 111[.]170[.]148[.]132:10002 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 3[.]87[.]86[.]71:7443 | botnet_cc | 2026-09-13 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["167.233.243.9", "3.87.86.71", "111.170.148.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.233.243.9", "3.87.86.71", "111.170.148.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["mail.leciano.ch", "holopolsglobal.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://mail.leciano.ch/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
ansible or Terraform to provision a new Linux bastion host, where the initialization script downloads a generic curl or wget binary from a public mirror that matches one of the 6 IOCs (e.g., a specific SHA256 hash of a standard build artifact).
ansible-playbook, terraform apply, or cloud-init and the destination path is within /usr/local/bin/ or /opt/ directories.rsync to sync configuration files from a staging server to production, where the staging server hosts a temporary copy of a known utility binary (e.g., jq or yq) that happens to match an IOC hash due to a specific build version.
10.20.0.0/24) and the destination user is a service account like svc-sync or admin-patch.node or python) from a private artifact repository, where the binary hash matches an IOC because the repository hosts a custom-compiled version that coincidentally shares a hash with a known malware sample.
jenkins-agent, gitlab-runner, or azure-pipelines-agent and the working directory is within the standard workspace paths (e.g., /var/lib/jenkins/workspace/ or /home/gitlab-runner/builds/).