ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential compromise by monitoring network and endpoint activity against nine specific indicators of unknown malware that may not yet be covered by existing signatures. A proactive hunt is essential in Azure Sentinel to rapidly isolate these emerging threats before they establish persistence or propagate laterally across the environment, thereby minimizing dwell time for novel malicious actors.

IOC Summary

Malware Family: Unknown malware Total IOCs: 9 IOC Types: domain, ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["20.119.73.195", "45.141.148.134", "102.117.171.26", "82.165.202.90", "213.165.50.109"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["20.119.73.195", "45.141.148.134", "102.117.171.26", "82.165.202.90", "213.165.50.109"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["guard7.barnfabric.click"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://165.22.225.110/commands", "http://165.22.225.110/responses.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including targeted filters and exclusions:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: Scheduled daily scans by Microsoft Defender for Endpoint or CrowdStrike Falcon generate temporary network connections to their cloud update servers. These connections often utilize dynamic IP ranges that may not be in the ThreatFox IOC database yet, triggering alerts on “Unknown” traffic patterns.
  • Filter/Exclusion: Exclude source IPs belonging to the organization’s internal Endpoint Protection management nodes and destination ports associated with the specific vendor (e.g., Destination Port 443 AND Source IP Range: 10.x.x.x for Defender).

• Scenario: Automated Software Deployment via SCCM

  • Context: Microsoft System Center Configuration Manager (SCCM) pushes new application packages to workstations during maintenance windows. The deployment agents download large payloads from internal distribution points or external repositories, creating high-volume traffic that mimics malware beaconing behavior.
  • Filter/Exclusion: Create a rule exclusion for processes named ccmsetup.exe and WUAUService when the destination is within the corporate DMZ IP range, specifically during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Cloud Backup Agent Heartbeats

  • Context: Agents from backup solutions like Veeam Backup & Replication or Rubrik perform continuous data protection and heartbeat checks. These agents frequently initiate connections to external S3 buckets or cloud gateways using IP addresses that rotate periodically, appearing as unknown IOCs.
  • Filter/Exclusion: Filter out alerts where the process name matches VeeamAgent.exe or rubrik-agent AND