ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection identifies potential unknown malware infections by correlating five distinct indicators of compromise that may evade standard signature-based defenses. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly isolate early-stage threats before they establish persistence or exfiltrate sensitive data from the environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 5 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["18.190.175.45", "194.26.192.117", "154.220.94.57", "18.136.74.230"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["18.190.175.45", "194.26.192.117", "154.220.94.57", "18.136.74.230"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["mekasa.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Engine Updates & Signature Refreshes

  • Scenario: The deployment of new virus definition updates via tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne. During the update cycle, these agents often generate temporary network connections to vendor update servers and execute local file integrity checks on newly downloaded signature databases. These activities create transient IOCs (new hashes, specific outbound ports) that may not yet be present in the ThreatFox global reputation database, triggering an “Unknown” alert.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from known vendor update subnets (e.g., 10.x.x.x ranges for CrowdStrike or Microsoft Azure Update endpoints) and specifically filtering out processes named CfEngine.exe, MsMpEng.exe, or S1Service.exe when communicating with their respective update domains.

• Automated Software Deployment via Configuration Management

  • Scenario: Scheduled nightly jobs executed by Ansible, Puppet, or SCCM (System Center Configuration Manager) that push new application binaries to workstations. When a new version of an internal line-of-business application is deployed, the installer executable and its associated DLLs generate fresh hashes. If this deployment occurs outside of the standard change window or involves a newly released patch not yet ingested by ThreatFox, the detection logic flags these legitimate installation artifacts as unknown malware IOCs.
  • Filter/Exclusion: Implement an exclusion based on the initiating service account (e.g., DOMAIN\SCCM_Service_Account or ansible-runner) and restrict alerts to only trigger if the file path is outside of standard deployment directories like C:\Windows\CCMCache or