This detection rule identifies potential unknown malware threats by correlating six distinct Indicators of Compromise (IOCs) that may evade traditional signature-based defenses. Proactively hunting for these signals in Azure Sentinel is critical to uncover stealthy adversary activity before it escalates into a confirmed incident, ensuring rapid containment of novel malicious behaviors.
Malware Family: Unknown malware Total IOCs: 6 IOC Types: domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | smtp.freshtlemanbarbershop.com | payload_delivery | 2026-08-30 | 90% |
| ip:port | 111[.]230[.]143[.]136:8080 | botnet_cc | 2026-08-30 | 100% |
| ip:port | 111[.]230[.]143[.]136:80 | botnet_cc | 2026-08-30 | 100% |
| ip:port | 111[.]230[.]143[.]136:443 | botnet_cc | 2026-08-30 | 100% |
| ip:port | 111[.]230[.]143[.]136:60000 | botnet_cc | 2026-08-30 | 100% |
| ip:port | 89[.]126[.]249[.]219:7443 | botnet_cc | 2026-08-30 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["111.230.143.136", "89.126.249.219"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["111.230.143.136", "89.126.249.219"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["smtp.freshtlemanbarbershop.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including targeted filters and exclusions tailored for an enterprise environment:
Scenario: Antivirus Definition Updates via Scheduled Tasks
Microsoft Defender Update (or Symantec Endpoint Protection) downloads new signature definition files from the vendor’s cloud repository. These files often contain unique hashes that have not yet been ingested into ThreatFox, triggering an “Unknown” alert.%ProgramData%\Microsoft\Windows Defender\Platform or %AllUsersProfile%\Symantec Endpoint Protection\Defs. Additionally, filter out events where the process name is MpCmdRun.exe (Defender) or ruagent.exe (Symantec) occurring between 02:00 and 04:00 local time.Scenario: Deployment of Internal Patching Tools
PatchDeploy_v2.exe) to 500+ workstations. Since this is an internally developed tool, its hash and IOCs are not present in the public ThreatFox database.PatchDeploy_v2.exe. Alternatively, exclude all alerts where the parent process is ccmexec.exe (SCCM) or ansible-runner, provided the file path resides within the internal distribution point directory (e.g., \\FileServer\Software\Patches\).Scenario: Legitimate Third-Party Cloud Backup Agents