ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This rule detects the presence of six specific indicators of compromise associated with an unidentified malware strain, signaling a potential active infection or staging activity within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised assets before the unknown malware can establish persistence or execute lateral movement.

IOC Summary

Malware Family: Unknown malware Total IOCs: 6 IOC Types: url, domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["193.111.77.180", "92.223.85.43", "111.170.148.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.111.77.180", "92.223.85.43", "111.170.148.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["casasdeplayacostarica.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://balancasriograndense.com.br/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A DevOps engineer uses Ansible or Terraform to provision new cloud infrastructure, where the automation framework temporarily downloads and executes a generic build script or container image layer that matches one of the 6 IOCs (e.g., a specific SHA256 hash or file path).
  • Filter/Exclusion: Exclude events where the parent process is ansible-playbook.exe, terraform.exe, or kubectl.exe and the user account belongs to the svc-devops or ci-cd service account group.
• Scenario: The Microsoft Defender for Endpoint or CrowdStrike Falcon agent performs a routine integrity check or updates its local rule database, creating a temporary file in %TEMP% or C:\ProgramData that matches an IOC file path or hash.
  • Filter/Exclusion: Exclude alerts where the process name is MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) and the file path contains ProgramData or Temp directories associated with known EDR vendor folders.
• Scenario: A system administrator runs a PowerShell script to deploy a new internal tool or patch, which involves downloading a .zip or .tar.gz archive from the internal file server and extracting it to a working directory, triggering a file hash or path-based IOC.
  • Filter/Exclusion: Exclude events where the command line contains Expand-Archive or tar -x and the source path is on the internal file server (e.g., \\fileserver01\tools\) or the user is in the Domain Admins or IT-Admins group.
• Scenario: A scheduled Task Scheduler job runs a nightly log rotation or cleanup script that moves or deletes files in a directory