ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating nine specific Indicators of Compromise (IOCs) that may represent emerging threats not yet covered by existing signature-based defenses. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect and contain novel malicious activity before it escalates, ensuring the organization maintains resilience against evolving attack vectors that traditional rules might miss.

IOC Summary

Malware Family: Unknown malware Total IOCs: 9 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["43.143.118.200", "79.133.42.25", "38.76.165.176", "45.77.75.145", "178.16.55.227"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.143.118.200", "79.133.42.25", "38.76.165.176", "45.77.75.145", "178.16.55.227"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["sigmagranni1.fun", "bratibobotito.fun"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://befaes.mom/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, detailing legitimate enterprise activities that may trigger alerts along with recommended filters or exclusions:

• Software Deployment via SCCM/Intune Pushing New Binaries

  • Scenario: When System Center Configuration Manager (SCCM) or Microsoft Intune pushes a new software update to endpoints, the installer executable often has a hash that is not yet present in the global ThreatFox IOCs database. The detection logic flags this “unknown” binary as potential malware immediately upon execution before it is ingested into the threat intelligence feed.
  • Filter/Exclusion: Create an exclusion rule for file hashes belonging to known deployment packages (e.g., *.msi, *.exe from the C:\Windows\CCM\ or C:\Program Files\Microsoft Intune Agent\ directories) if they are executed by the ccmsetup.exe or IntuneAgent.exe parent process.

• Scheduled PowerShell Script Execution for Data Backups

  • Scenario: A nightly scheduled task runs a custom PowerShell script (e.g., Backup-Database.ps1) that invokes external tools like mysqldump or proprietary backup agents. These scripts often generate temporary executables or call specific DLLs with hashes that are unique to the internal environment and not yet cataloged in ThreatFox, triggering an “Unknown IOCs” alert during the maintenance window (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for this rule between 01:00 and 05:00 UTC, or exclude specific file paths associated with the backup job (e.g., C:\Scripts\Backup\) when executed by the Task Scheduler service (`sv