ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating 21 specific indicators of compromise (IOCs) that may evade signature-based defenses. A proactive hunt is essential in Azure Sentinel to rapidly isolate and investigate these emerging threats before they establish persistence or propagate laterally across the enterprise network.

IOC Summary

Malware Family: Unknown malware Total IOCs: 21 IOC Types: ip:port, url, domain

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://sergiomarquesillustration.com/`	payload_delivery	2026-08-23	90%
domain	`wingji.com`	payload_delivery	2026-08-23	90%
ip:port	`89[.]144[.]53[.]144:7443`	botnet_cc	2026-08-23	100%
url	`hxxps://royalvet.es/`	payload_delivery	2026-08-23	90%
url	`hxxps://thinkomdigital.com/`	payload_delivery	2026-08-23	90%
ip:port	`111[.]170[.]148[.]132:5080`	botnet_cc	2026-08-23	100%
ip:port	`38[.]76[.]183[.]197:60000`	botnet_cc	2026-08-23	100%
ip:port	`45[.]8[.]46[.]122:8888`	botnet_cc	2026-08-23	100%
domain	`indogenband.com`	payload_delivery	2026-08-23	90%
ip:port	`106[.]54[.]41[.]209:81`	botnet_cc	2026-08-23	100%
ip:port	`45[.]8[.]46[.]122:22`	botnet_cc	2026-08-23	100%
ip:port	`45[.]8[.]46[.]122:5432`	botnet_cc	2026-08-23	100%
domain	`giftcardbazaar.com`	payload_delivery	2026-08-23	90%
url	`hxxps://hzindia.com/`	payload_delivery	2026-08-23	90%
url	`hxxps://josephonetech.com/`	payload_delivery	2026-08-23	90%
url	`hxxps://moat55.com/`	payload_delivery	2026-08-23	90%
ip:port	`43[.]136[.]99[.]254:10001`	botnet_cc	2026-08-23	100%
url	`hxxps://homeinnovationsunlimited.com/`	payload_delivery	2026-08-23	90%
url	`hxxps://authenticcarebd.xyz/`	payload_delivery	2026-08-23	90%
url	`hxxps://archaicpixels.com/`	payload_delivery	2026-08-23	90%
url	`hxxps://jocoaching.life/`	payload_delivery	2026-08-23	90%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["89.144.53.144", "43.136.99.254", "106.54.41.209", "45.8.46.122", "111.170.148.132", "38.76.183.197"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["89.144.53.144", "43.136.99.254", "106.54.41.209", "45.8.46.122", "111.170.148.132", "38.76.183.197"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["wingji.com", "indogenband.com", "giftcardbazaar.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://sergiomarquesillustration.com/", "https://royalvet.es/", "https://thinkomdigital.com/", "https://hzindia.com/", "https://josephonetech.com/", "https://moat55.com/", "https://homeinnovationsunlimited.com/", "https://authenticcarebd.xyz/", "https://archaicpixels.com/", "https://jocoaching.life/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs detection rule:

Scenario: Scheduled Antivirus Definition Updates
- Context: Enterprise endpoint protection suites (e.g., Microsoft Defender, CrowdStrike Falcon) automatically download new signature databases or heuristic engines from their cloud repositories. These updates often generate network traffic to unknown external IPs and hash values that the ThreatFox feed has not yet indexed as “known good,” triggering an alert for unknown malware IOCs.
- Filter/Exclusion: Create a whitelist exclusion based on the specific vendor’s update server IP ranges (e.g., 13.107.x.x for Microsoft) and exclude file hashes associated with the .cab or .dat extension used by these specific update packages during their scheduled maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Patch Management Deployment via SCCM/Intune
- Context: During monthly patch cycles, System Center Configuration Manager (SCCM) or Microsoft Intune pushes new application binaries and scripts to endpoints. The initial deployment of a new software version often involves downloading executable files with fresh hashes that do not yet exist in the ThreatFox intelligence database, causing the rule to flag them as unknown malware IOCs.
- Filter/Exclusion: Implement an exclusion logic that suppresses alerts for processes initiated by ccmsetup.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically when the source IP belongs to the internal patch management server subnet, and the file extension is .msi or .exe.
Scenario: Automated Backup and Archiving Jobs
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run nightly jobs that compress and transfer large data sets to cloud storage (e.g.,