ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt targets the presence of nine specific IOCs linked to unknown malware, which may indicate an active or dormant compromise within the environment. Proactively hunting for these indicators in Azure Sentinel is critical to identify stealthy threats that traditional signature-based detections might miss, allowing the SOC to isolate affected assets before the adversary establishes persistence or exfiltrates data.

IOC Summary

Malware Family: Unknown malware Total IOCs: 9 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["155.138.198.108"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["155.138.198.108"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://kairostksc.com/", "http://www.az888us.com/Vetx/adduser.php", "https://az888us.com/Vetx/adduser.php", "https://az888us.com/Vetx/tasks.php", "https://www.az888us.com/Vetx/tasks.php", "https://www.az888us.com/Vetx/adduser.php", "http://www.az888us.com/Vetx/tasks.php", "https://ira-company.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A DevOps team uses Ansible or Terraform to deploy a new microservice container image that includes a static binary or script matching one of the 9 IOCs (e.g., a specific SHA256 hash or file path) for a legitimate utility like jq, curl, or a custom health-check script.

  • Filter/Exclusion: Exclude alerts where the process parent is ansible-playbook, terraform apply, or docker run, and the file location is within standard deployment directories such as /opt/app/bin/ or /usr/local/lib/.

• Scenario: An IT administrator runs a scheduled PowerShell script via Task Scheduler to clean up temporary files or rotate logs, and the script invokes a known tool (e.g., 7z.exe or tar.exe) that matches an IOC based on its file path or hash, often located in C:\Program Files\ or C:\Tools\.

  • Filter/Exclusion: Exclude alerts where the process name is powershell.exe or pwsh.exe and the parent process is schtasks.exe or taskeng.exe, with the working directory set to a standard admin utility path like C:\Admin\Scripts\ or C:\Tools\.

• Scenario: A security engineer performs a manual vulnerability scan using Nmap or Masscan from a jump host, and the scanner’s binary or a helper script matches an IOC due to a generic hash or path pattern (e.g., /usr/local/bin/nmap or a specific plugin path).

  • Filter/Exclusion: Exclude alerts where the process name is nmap, masscan, or zmap, and the user account belongs to the SecurityOps or BlueTeam AD group, with the execution originating from