This hunt detects adversary behavior characterized by the presence of forty-three distinct indicators of compromise (IOCs) linked to previously unidentified malware strains that may evade standard signature-based detection. The SOC team should proactively hunt for these unknown threats within Azure Sentinel to rapidly identify and contain emerging malicious activity before it establishes persistence or spreads laterally across the enterprise network.
Malware Family: Unknown malware Total IOCs: 43 IOC Types: domain, url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 175[.]43[.]223[.]195:7443 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 155[.]117[.]40[.]213:7721 | botnet_cc | 2026-08-25 | 75% |
| domain | orbitcnc.twilightparadox.com | botnet_cc | 2026-08-25 | 90% |
| domain | updatemc.twilightparadox.com | botnet_cc | 2026-08-25 | 90% |
| ip:port | 176[.]65[.]139[.]248:10293 | botnet_cc | 2026-08-25 | 90% |
| url | hxxps://mail.quwatt.com/ | payload_delivery | 2026-08-25 | 90% |
| url | hxxps://balloonfest.com.br/ | payload_delivery | 2026-08-25 | 90% |
| url | hxxps://dev.rushtaxresolution.com/ | payload_delivery | 2026-08-25 | 90% |
| ip:port | 43[.]155[.]168[.]253:3232 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 45[.]8[.]46[.]122:8080 | botnet_cc | 2026-08-25 | 100% |
| domain | easycompany.ch | payload_delivery | 2026-08-25 | 90% |
| url | hxxp://176[.]65[.]139[.]196/bins/kla.sh | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/parm | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/parm5 | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/parm6 | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/parm7 | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/pm68k | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/pmips | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]196/bins/pmpsl | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.arc | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.armv4l | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.armv5l | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.armv6l | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.armv7l | payload_delivery | 2026-08-25 | 80% |
| url | hxxp://176[.]65[.]139[.]202/daredevil.i486 | payload_delivery | 2026-08-25 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["155.117.40.213", "45.8.46.122", "43.155.168.253", "176.65.139.248", "175.43.223.195"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["155.117.40.213", "45.8.46.122", "43.155.168.253", "176.65.139.248", "175.43.223.195"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["orbitcnc.twilightparadox.com", "updatemc.twilightparadox.com", "easycompany.ch", "duroelectric.com", "uptimekmart.checkpointsystems.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://mail.quwatt.com/", "https://balloonfest.com.br/", "https://dev.rushtaxresolution.com/", "http://176.65.139.196/bins/kla.sh", "http://176.65.139.196/bins/parm", "http://176.65.139.196/bins/parm5", "http://176.65.139.196/bins/parm6", "http://176.65.139.196/bins/parm7", "http://176.65.139.196/bins/pm68k", "http://176.65.139.196/bins/pmips", "http://176.65.139.196/bins/pmpsl", "http://176.65.139.202/daredevil.arc", "http://176.65.139.202/daredevil.armv4l", "http://176.65.139.202/daredevil.armv5l", "http://176.65.139.202/daredevil.armv6l", "http://176.65.139.202/daredevil.armv7l", "http://176.65.139.202/daredevil.i486", "http://176.65.139.202/daredevil.m68k", "http://198.144.179.82:80/1.sh", "http://176.65.139.202/daredevil.mips", "http://176.65.139.202/daredevil.sh4", "http://176.65.139.202:80/tplinkrouter.sh", "http://176.65.139.196/bins/px86", "http://176.65.139.196/bins/psh4", "http://176.65.139.202/a.sh", "http://176.65.139.202/daredevil.x86_64", "http://176.65.139.202/daredevil.mipsel", "http://176.65.139.202:80/telnet.sh", "http://176.65.139.196/bins/pppc", "http://176.65.139.202/totolink.sh"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:
Scenario: Automated Patching and Software Updates
10.20.30.0/24) and exclude file paths matching known update directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates\*).Scenario: Scheduled Backup and Archiving Jobs
.vbk, .v2i, .bck) and filter out alerts originating from specific service accounts running these jobs (e.g., DOMAIN\svc-veeam-backup or DOMAIN\commvault-svc).Scenario: CI/CD Pipeline Artifact Deployment