This hunt targets the presence of 24 known indicators of compromise associated with unidentified malware, which may signal an active or dormant threat that has evaded traditional signature-based detection. Proactively hunting for these IOCs in Azure Sentinel is critical to identify potential lateral movement or persistence mechanisms before the unknown malware can establish a foothold and escalate privileges within the environment.
Malware Family: Unknown malware Total IOCs: 24 IOC Types: url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://104[.]239[.]66[.]104:8888/1/reosmesf967rgeaveon.jug | payload_delivery | 2026-09-08 | 85% |
| url | hxxps://sygnifin.ingeniousc.com/wp-content/uploads/2026/08/ScreenConnect.ClientSetup.msi | payload_delivery | 2026-09-08 | 85% |
| url | hxxp://177[.]70[.]102[.]232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2023-10-04/info.zip | payload_delivery | 2026-09-08 | 75% |
| url | hxxp://177[.]70[.]102[.]228:8070/tmpftp/01/cancelamento/2021-08-26/info.zip | payload_delivery | 2026-09-08 | 75% |
| url | hxxp://177[.]70[.]102[.]228:8070/tmpftp/01/cancelamento/2021-03-17/info.zip | payload_delivery | 2026-09-08 | 75% |
| ip:port | 78[.]39[.]51[.]23:7443 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 34[.]134[.]117[.]89:7443 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 220[.]154[.]128[.]196:8766 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 220[.]154[.]128[.]196:9003 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 175[.]43[.]223[.]201:7443 | botnet_cc | 2026-09-08 | 75% |
| url | hxxps://mghirealty.com/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://getlemon.lol/files/LemonClix.exe | payload_delivery | 2026-09-08 | 85% |
| url | hxxp://177[.]70[.]102[.]232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2020-12-07/info.zip | payload_delivery | 2026-09-08 | 75% |
| url | hxxp://177[.]70[.]102[.]232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2020-08-26/info.zip | payload_delivery | 2026-09-08 | 75% |
| url | hxxp://188[.]212[.]158[.]75/5556.rar | payload_delivery | 2026-09-08 | 85% |
| url | hxxp://186[.]235[.]86[.]129/av.scr | payload_delivery | 2026-09-08 | 85% |
| url | hxxps://karen.ilawa.pl/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://tranquini.com/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://honigvogel.com/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://sangdelaterre.fr/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://vampfittelite.com/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://www.lesdemeuresdemilie.com/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://www.smaeck.be/ | payload_delivery | 2026-09-08 | 90% |
| url | hxxps://headstartlearningtuition.com/ | payload_delivery | 2026-09-08 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["78.39.51.23", "34.134.117.89", "220.154.128.196", "175.43.223.201"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["78.39.51.23", "34.134.117.89", "220.154.128.196", "175.43.223.201"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://104.239.66.104:8888/1/reosmesf967rgeaveon.jug", "https://sygnifin.ingeniousc.com/wp-content/uploads/2026/08/ScreenConnect.ClientSetup.msi", "http://177.70.102.232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2023-10-04/info.zip", "http://177.70.102.228:8070/tmpftp/01/cancelamento/2021-08-26/info.zip", "http://177.70.102.228:8070/tmpftp/01/cancelamento/2021-03-17/info.zip", "https://mghirealty.com/", "https://getlemon.lol/files/LemonClix.exe", "http://177.70.102.232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2020-12-07/info.zip", "http://177.70.102.232:8070/TmpFTP/01/Recep%C3%A7%C3%A3o/2020-08-26/info.zip", "http://188.212.158.75/5556.rar", "http://186.235.86.129/av.scr", "https://karen.ilawa.pl/", "https://tranquini.com/", "https://honigvogel.com/", "https://sangdelaterre.fr/", "https://vampfittelite.com/", "https://www.lesdemeuresdemilie.com/", "https://www.smaeck.be/", "https://headstartlearningtuition.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses curl or wget to download a specific version of a CI/CD agent (e.g., Jenkins agent, GitLab Runner) or a monitoring tool (e.g., Datadog agent, New Relic) from a known vendor’s CDN or artifact repository. The binary or installer hash matches one of the 24 IOCs because the vendor recently released a build that was previously flagged as suspicious or is a generic build identifier.
curl/7.x or wget/1.x and the destination path is within standard application directories (e.g., /opt/, /usr/local/bin/, C:\Program Files\).Scenario: An IT administrator runs a scheduled PowerShell script or a cron job to patch or update a third-party application (e.g., Java JRE, Python packages, or a proprietary business app) that downloads a new version from a public mirror or vendor update server. The downloaded file’s SHA256 matches an IOC because the vendor’s update mechanism uses a generic or rotating hash that coincidentally matches a known malware sample.
powershell.exe or bash and the parent process is a known scheduled task runner (e.g., Task Scheduler, cron, systemd) and the file is written to a standard software installation directory (e.g., C:\Program Files (x86)\, /usr/share/, /opt/).Scenario: A security team or application owner performs a manual vulnerability scan or integrity check using a tool like clamscan, yara, or a custom