This hunt targets the presence of 29 specific indicators of compromise associated with unknown malware, which may indicate an active or dormant infection within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the adversary can establish persistence or execute further malicious actions.
Malware Family: Unknown malware Total IOCs: 29 IOC Types: domain, url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 95[.]31[.]213[.]79:443 | botnet_cc | 2026-09-10 | 75% |
| ip:port | 18[.]142[.]104[.]108:8088 | botnet_cc | 2026-09-10 | 75% |
| url | hxxp://117[.]240[.]155[.]245:30270/sshd | payload_delivery | 2026-09-10 | 100% |
| url | hxxp://103[.]226[.]249[.]227:86/info.zip | payload_delivery | 2026-09-10 | 100% |
| url | hxxp://102[.]212[.]61[.]41:8026/sshd | payload_delivery | 2026-09-10 | 100% |
| ip:port | 86[.]109[.]75[.]162:8080 | botnet_cc | 2026-09-10 | 75% |
| url | hxxp://86[.]109[.]75[.]162:8080/api/v1/agent/ping | botnet_cc | 2026-09-10 | 100% |
| url | hxxp://86[.]109[.]75[.]162:8080/api/v1/agent/tasks | botnet_cc | 2026-09-10 | 100% |
| url | hxxp://86[.]109[.]75[.]162:8080/api/v1/checkin | botnet_cc | 2026-09-10 | 100% |
| url | hxxps://gunbuyerclub.com | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://notion-brown.com/4qX0LB/tm/oPpE | payload_delivery | 2026-09-10 | 80% |
| url | hxxp://178[.]198[.]246[.]24/Photo.scr | payload_delivery | 2026-09-10 | 85% |
| url | hxxp://177[.]70[.]102[.]232:8070/tmpftp/01/recep%C3%A7%C3%A3o/2022-09-05/info.zip | payload_delivery | 2026-09-10 | 75% |
| url | hxxps://178[.]16[.]52[.]221/Bin/ScreenConnect.ClientSetup.exe | payload_delivery | 2026-09-10 | 85% |
| url | hxxp://95[.]62[.]202[.]150:10071/sshd | payload_delivery | 2026-09-10 | 85% |
| url | hxxp://103[.]20[.]213[.]34:8080/uploads/uploads/aryacorp%20delhi/backgrounds/info.zip | payload_delivery | 2026-09-10 | 75% |
| url | hxxps://netstreamplus.com/get_verify | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://ssospace.net | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://netstreamplus.com/first_allow_host | payload_delivery | 2026-09-10 | 80% |
| domain | logm-justia.com | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://csswaytech.net/js/all.min.js | payload_delivery | 2026-09-10 | 80% |
| domain | ssospace.net | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://netstreamplus.com/js/all.min.js | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://csswaytech.net/get_verify | payload_delivery | 2026-09-10 | 80% |
| url | hxxps://ssospace.net/first_allow_host | payload_delivery | 2026-09-10 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["86.109.75.162", "18.142.104.108", "95.31.213.79"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["86.109.75.162", "18.142.104.108", "95.31.213.79"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["logm-justia.com", "ssospace.net", "netstreamplus.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://117.240.155.245:30270/sshd", "http://103.226.249.227:86/info.zip", "http://102.212.61.41:8026/sshd", "http://86.109.75.162:8080/api/v1/agent/ping", "http://86.109.75.162:8080/api/v1/agent/tasks", "http://86.109.75.162:8080/api/v1/checkin", "https://gunbuyerclub.com", "https://notion-brown.com/4qX0LB/tm/oPpE", "http://178.198.246.24/Photo.scr", "http://177.70.102.232:8070/tmpftp/01/recep%C3%A7%C3%A3o/2022-09-05/info.zip", "https://178.16.52.221/Bin/ScreenConnect.ClientSetup.exe", "http://95.62.202.150:10071/sshd", "http://103.20.213.34:8080/uploads/uploads/aryacorp%20delhi/backgrounds/info.zip", "https://netstreamplus.com/get_verify", "https://ssospace.net", "https://netstreamplus.com/first_allow_host", "https://csswaytech.net/js/all.min.js", "https://netstreamplus.com/js/all.min.js", "https://csswaytech.net/get_verify", "https://ssospace.net/first_allow_host", "https://logm-justia.com", "https://ssospace.net/js/all.min.js", "https://csswaytech.net/first_allow_host"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a new YARA rule or Sigma correlation logic that references specific memory offsets, hash values, or registry keys associated with the “Unknown malware” family for testing purposes. If these IOCs (e.g., specific file hashes or process command lines) are embedded in the test script or configuration file, the detection engine may flag the test artifact itself as a match.
yara.exe, sigma-cli, splunk.exe) or where the file path resides in dedicated security tool directories (e.g., C:\Program Files\YARA\, C:\Tools\Sigma\).Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files or reset user profiles, which inadvertently creates or modifies a file with a name or hash that matches one of the 29 IOCs (e.g., a generic name like update.tmp or a specific hash collision in a legacy application).
powershell.exe or pwsh.exe and the command line contains standard cleanup verbs (e.g., Remove-Item, Clear-RecycleBin, Reset-Profile) or where the file path is within standard temporary directories (%TEMP%, C:\Windows\Temp).Scenario: A third-party application (e.g., a PDF viewer, media player, or IDE) bundles a helper DLL or executable with a known hash or filename that overlaps with the “Unknown malware” IOCs due to shared code libraries or generic naming conventions (e.g., helper.dll, core.exe).