ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware threats by correlating four specific indicators of compromise (IOCs) that may represent novel or evolving adversary behaviors not yet covered by existing signatures. Proactively hunting for these IOCs in Azure Sentinel is critical to ensure early discovery and rapid containment of emerging threats before they can establish persistence or spread laterally across the environment.

IOC Summary

Malware Family: Unknown malware Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`129[.]80[.]106[.]68:443`	botnet_cc	2026-08-31	75%
ip:port	`117[.]72[.]202[.]93:8000`	botnet_cc	2026-08-31	100%
ip:port	`1[.]117[.]77[.]166:888`	botnet_cc	2026-08-31	100%
ip:port	`91[.]92[.]43[.]15:4444`	botnet_cc	2026-08-31	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["117.72.202.93", "1.117.77.166", "129.80.106.68", "91.92.43.15"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["117.72.202.93", "1.117.77.166", "129.80.106.68", "91.92.43.15"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Automated Security Tool Updates
- Context: The endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads and executes new definition updates. These updates often contain new hash signatures that have not yet been ingested into the ThreatFox threat intelligence feed, triggering a match against “Unknown” IOCs.
- Filter/Exclusion: Create an exclusion rule based on the process name of the update service (e.g., C:\Program Files\CrowdStrike\fsq.exe or MsMpEng.exe) and restrict the detection to exclude file paths within the vendor’s installation directory (C:\ProgramData\Microsoft\Windows Defender\).
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions like Veeam or Commvault run nightly jobs that generate large temporary archive files (.vbk, .vmdk) with unique hashes. Since these files are generated dynamically by the backup engine, their IOCs appear “unknown” to ThreatFox until manually added to the whitelist.
- Filter/Exclusion: Exclude file extensions specific to the backup tool (e.g., .vbk, .vmdk, .b2d) and add a filter for processes running under the dedicated service account used by the backup software (e.g., DOMAIN\VeeamServiceAccount).
Scenario: Development Build Artifacts in CI/CD Pipelines
- Context: In DevOps environments, Jenkins or GitLab runners compile code and generate build artifacts (DLLs, EXEs) that are subsequently scanned. These newly compiled binaries possess unique hashes that do not exist in the global threat intelligence database yet, causing