This hunt targets adversary behavior involving the execution of unknown malware by correlating 18 specific Indicators of Compromise (IOCs) against Azure Sentinel telemetry to identify early-stage infections. Proactively hunting for these IOCs is critical because it enables the SOC team to detect and contain novel threats before they establish persistence or exfiltrate sensitive data within the cloud environment.
Malware Family: Unknown malware Total IOCs: 18 IOC Types: domain, ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 96[.]44[.]138[.]102:80 | botnet_cc | 2026-07-12 | 100% |
| ip:port | 96[.]44[.]138[.]102:8080 | botnet_cc | 2026-07-12 | 100% |
| ip:port | 96[.]44[.]138[.]102:443 | botnet_cc | 2026-07-12 | 100% |
| ip:port | 96[.]44[.]138[.]102:60000 | botnet_cc | 2026-07-12 | 100% |
| ip:port | 93[.]95[.]226[.]207:7443 | botnet_cc | 2026-07-12 | 75% |
| ip:port | 104[.]207[.]93[.]150:443 | botnet_cc | 2026-07-12 | 75% |
| ip:port | 104[.]207[.]93[.]150:7443 | botnet_cc | 2026-07-12 | 75% |
| domain | i-like-ele-phants-verification.live | botnet_cc | 2026-07-12 | 75% |
| domain | inoxarreda.it | payload_delivery | 2026-07-12 | 75% |
| domain | tecnoibrid.com | payload_delivery | 2026-07-12 | 75% |
| url | hxxps://mhw.codes/check | payload_delivery | 2026-07-12 | 90% |
| ip:port | 66[.]92[.]249[.]136:8888 | botnet_cc | 2026-07-12 | 100% |
| url | hxxp://178[.]17[.]59[.]40:5506/qk.vbs | payload_delivery | 2026-07-11 | 90% |
| url | hxxp://inkbookwriters.com/verify | payload_delivery | 2026-07-11 | 90% |
| ip:port | 103[.]236[.]95[.]191:8080 | botnet_cc | 2026-07-11 | 100% |
| ip:port | 103[.]236[.]95[.]191:80 | botnet_cc | 2026-07-11 | 100% |
| ip:port | 103[.]236[.]95[.]191:60000 | botnet_cc | 2026-07-11 | 100% |
| ip:port | 103[.]236[.]95[.]191:443 | botnet_cc | 2026-07-11 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["103.236.95.191", "66.92.249.136", "96.44.138.102", "104.207.93.150", "93.95.226.207"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["103.236.95.191", "66.92.249.136", "96.44.138.102", "104.207.93.150", "93.95.226.207"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["i-like-ele-phants-verification.live", "inoxarreda.it", "tecnoibrid.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://mhw.codes/check", "http://178.17.59.40:5506/qk.vbs", "http://inkbookwriters.com/verify"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Enterprise Antivirus Definition Updates via Windows Update
Microsoft Defender Antivirus (or third-party agents like CrowdStrike or SentinelOne) downloads and installs new signature definitions. These updates often introduce temporary network connections to vendor update servers (e.g., go.microsoft.com, updates.crowdstrike.com) that may not yet be fully whitelisted in the ThreatFox IOC database, triggering alerts for “unknown” file hashes or network endpoints during the installation window.OS-Server or OS-Workstation. Alternatively, add the known update server IP ranges and specific file paths (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates) to the IOC whitelist.Software Deployment via SCCM/Intune Pushing New Applications
Finance department. The deployment agent extracts temporary installer files and executes setup scripts that generate file hashes and network traffic patterns not yet present in the ThreatFox “Unknown malware” baseline, causing the hunt package to flag these legitimate installation artifacts as potential threats.Process_Name matches known deployment agents (e.g., ccmexec.exe, `IntuneManagementExtension.exe