This rule detects the presence of 23 known indicators of compromise associated with an unidentified malware strain, signaling a potential active infection or recent compromise within the environment. Proactively hunting for these IOCs allows the SOC team to identify and isolate affected assets before the unknown malware can establish persistence or execute lateral movement, reducing the overall risk exposure in the Azure Sentinel environment.
Malware Family: Unknown malware Total IOCs: 23 IOC Types: ip:port, domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 125[.]75[.]36[.]126:30272 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 125[.]75[.]36[.]126:50551 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 125[.]75[.]36[.]126:59214 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 125[.]75[.]36[.]126:80 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 95[.]158[.]131[.]149:7443 | botnet_cc | 2026-09-16 | 75% |
| ip:port | 125[.]75[.]36[.]126:28120 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 125[.]75[.]36[.]126:9090 | botnet_cc | 2026-09-16 | 100% |
| ip:port | 125[.]75[.]36[.]126:8080 | botnet_cc | 2026-09-16 | 100% |
| url | hxxps://statpipeplus.com/get_verify | payload_delivery | 2026-09-16 | 80% |
| domain | statpipeplus.com | payload_delivery | 2026-09-16 | 80% |
| domain | tracewaytech.com | payload_delivery | 2026-09-16 | 80% |
| domain | ingestdot.net | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://ingestdot.net | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://tracewaytech.com/get_verify | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://ingestdot.net/first_allow_host | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://tracewaytech.com/first_allow_host | payload_delivery | 2026-09-16 | 80% |
| domain | pacer-gov.com | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://ingestdot.net/get_verify | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://ingestdot.net/js/all.min.js | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://tracewaytech.com/js/all.min.js | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://pacer-gov.com | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://statpipeplus.com/js/all.min.js | payload_delivery | 2026-09-16 | 80% |
| url | hxxps://statpipeplus.com/first_allow_host | payload_delivery | 2026-09-16 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["125.75.36.126", "95.158.131.149"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["125.75.36.126", "95.158.131.149"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["statpipeplus.com", "tracewaytech.com", "ingestdot.net", "pacer-gov.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://statpipeplus.com/get_verify", "https://ingestdot.net", "https://tracewaytech.com/get_verify", "https://ingestdot.net/first_allow_host", "https://tracewaytech.com/first_allow_host", "https://ingestdot.net/get_verify", "https://ingestdot.net/js/all.min.js", "https://tracewaytech.com/js/all.min.js", "https://pacer-gov.com", "https://statpipeplus.com/js/all.min.js", "https://statpipeplus.com/first_allow_host"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new containerized microservice using a custom-built image that includes a lightweight, unsigned binary (e.g., a custom health-check script or a specific version of curl/wget) for initial network validation. The binary’s hash matches one of the 23 IOCs because it is a common, open-source tool compiled with a specific flag set that ThreatFox has flagged as “unknown” due to recent distribution changes.
dockerd, containerd-shim, or kubectl, and the file path resides within standard container runtime directories (e.g., /var/lib/docker/overlay2/... or /var/lib/kubelet/...).Scenario: An IT administrator performs a manual patching task on a legacy Windows Server 2012 R2 host, downloading a specific hotfix installer from a trusted internal repository. The installer is a self-extracting archive that drops a temporary .exe file into %TEMP% or C:\Windows\Temp\, which matches an IOC hash associated with a known dropper behavior pattern, even though the source is internal and verified.
C:\Windows\Temp\ or %TEMP% AND the parent process is powershell.exe or cmd.exe with a command line containing Expand-Archive or 7z x, and the source IP is within the internal management subnet (e.g., 10.20.0.0/16).Scenario: A security engineer runs a YARA scan or a memory dump analysis tool (e.g., volatility or a custom Python script) on a test VM. The tool loads a small, unsigned helper library or script into memory or