This hunt targets the presence of eight specific indicators of compromise linked to an unidentified malware strain, which may indicate an active or dormant infection within the environment. Proactively searching for these IOCs in Azure Sentinel is critical to identify compromised assets early, as unknown malware often lacks distinct behavioral signatures and can establish persistence before traditional detections trigger.
Malware Family: Unknown malware Total IOCs: 8 IOC Types: ip:port, url, sha256_hash, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 07c0a0af63dde8dc2e36dc58b630dcad6563263e992877aaa704530afb8a5656 | payload | 2026-09-12 | 75% |
| ip:port | 65[.]108[.]13[.]44:7443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 208[.]167[.]253[.]21:7443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 187[.]145[.]61[.]38:7443 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 13[.]251[.]42[.]119:8088 | botnet_cc | 2026-09-12 | 75% |
| ip:port | 46[.]151[.]29[.]58:3232 | payload_delivery | 2026-09-12 | 75% |
| url | hxxps://imgcache.cdnsuicaches.com/60Vo | payload_delivery | 2026-09-12 | 90% |
| domain | hashedsolver.icu | payload_delivery | 2026-09-12 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["13.251.42.119", "187.145.61.38", "46.151.29.58", "208.167.253.21", "65.108.13.44"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["13.251.42.119", "187.145.61.38", "46.151.29.58", "208.167.253.21", "65.108.13.44"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["hashedsolver.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://imgcache.cdnsuicaches.com/60Vo"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["07c0a0af63dde8dc2e36dc58b630dcad6563263e992877aaa704530afb8a5656"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
ansible or Terraform to deploy configuration management scripts that include base64-encoded payloads or obfuscated strings for idempotency checks, which match the hex/base64 IOCs in the ThreatFox set.
ansible-playbook, terraform, or chef-client when the parent process is a service account or runs from standard /usr/local/bin or C:\Program Files\ paths.Cobalt Strike or Beacon in a sandboxed environment, where the beacon’s unique hash or memory pattern matches the “Unknown malware” IOCs.
10.200.0.0/24) or where the process name matches known red team binaries (e.g., beacon.exe, cobaltstrike.exe) and the user account is tagged with the RedTeam AD group.python3, node, java) and the working directory is within a standard development workspace (e.g., /home/dev/, C:\Users\dev\projects\) or the user account belongs to the DevTeam group.Veeam, Commvault) compress and