ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection identifies potential unknown malware threats by correlating twenty-five specific Indicators of Compromise (IOCs) that may evade signature-based defenses due to their novel nature. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly detect and contain emerging malicious activity before it establishes persistence or spreads laterally across the enterprise network.

IOC Summary

Malware Family: Unknown malware Total IOCs: 25 IOC Types: domain, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
domain	`ib3.ch`	payload_delivery	2026-08-18	90%
domain	`ville-haillicourt.fr`	payload_delivery	2026-08-18	90%
domain	`tchaffe.ch`	payload_delivery	2026-08-18	90%
domain	`tesladeathray.ch`	payload_delivery	2026-08-18	90%
ip:port	`36[.]248[.]232[.]166:7443`	botnet_cc	2026-08-18	75%
ip:port	`213[.]199[.]53[.]152:443`	botnet_cc	2026-08-18	75%
ip:port	`187[.]194[.]216[.]103:7443`	botnet_cc	2026-08-18	75%
domain	`mindglowingsolutions.com`	payload_delivery	2026-08-18	90%
url	`hxxps://chillifarmsukabumi.com/`	payload_delivery	2026-08-18	90%
domain	`cdtrefledor.ch`	payload_delivery	2026-08-18	90%
domain	`bungeedance.ch`	payload_delivery	2026-08-18	90%
domain	`bungeeyoga.ch`	payload_delivery	2026-08-18	90%
domain	`bungee-training.ch`	payload_delivery	2026-08-18	90%
domain	`vivactis-marketaccess.com`	payload_delivery	2026-08-18	90%
domain	`traitement-de-la-fibromyalgie.com`	payload_delivery	2026-08-18	90%
domain	`ilayacare.com`	payload_delivery	2026-08-18	90%
domain	`didox.org`	payload_delivery	2026-08-18	90%
domain	`studio-photo-lausanne.ch`	payload_delivery	2026-08-18	90%
domain	`xn--wscherei-leo-gcb.ch`	payload_delivery	2026-08-18	90%
domain	`papillon-schmuck.ch`	payload_delivery	2026-08-18	90%
domain	`alpeninitiative.ch`	payload_delivery	2026-08-18	90%
domain	`garageduvignoble.fr`	payload_delivery	2026-08-18	90%
domain	`srp-immobilienservice.ch`	payload_delivery	2026-08-18	90%
url	`hxxps://qorvi.pro/fdab9755.exe`	payload_delivery	2026-08-18	90%
domain	`energisol.ch`	payload_delivery	2026-08-18	90%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["36.248.232.166", "213.199.53.152", "187.194.216.103"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["36.248.232.166", "213.199.53.152", "187.194.216.103"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["ib3.ch", "ville-haillicourt.fr", "tchaffe.ch", "tesladeathray.ch", "mindglowingsolutions.com", "cdtrefledor.ch", "bungeedance.ch", "bungeeyoga.ch", "bungee-training.ch", "vivactis-marketaccess.com", "traitement-de-la-fibromyalgie.com", "ilayacare.com", "didox.org", "studio-photo-lausanne.ch", "xn--wscherei-leo-gcb.ch", "papillon-schmuck.ch", "alpeninitiative.ch", "garageduvignoble.fr", "srp-immobilienservice.ch", "energisol.ch"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://chillifarmsukabumi.com/", "https://qorvi.pro/fdab9755.exe"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters/exclusions for the ThreatFox: Unknown malware IOCs rule:

Scenario: Scheduled Antivirus Quarantine Scans by Enterprise EDR Agents
- Context: During nightly maintenance windows, tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne automatically scan the network and quarantine unknown files. These agents generate unique IOCs (hashes, URLs) that are not yet in the global ThreatFox database but represent legitimate security hygiene rather than a new threat.
- Filter/Exclusion: Exclude alerts where the source_hostname matches known EDR management servers or where the process_name contains keywords like “FalconSensor”, “MsMpEng.exe”, or “SentinelOneAgent”. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Automated Software Deployment via Configuration Management Tools
- Context: System administrators use tools like Ansible, SCCM (Microsoft Endpoint Configuration Manager), or Jenkins to push new application updates across the fleet. These deployments often introduce temporary executable hashes and download URLs that are unique to the internal build pipeline, triggering “Unknown” status in ThreatFox before being whitelisted globally.
- Filter/Exclusion: Create an exclusion rule for IOCs originating from specific IP ranges dedicated to deployment servers (e.g., 10.50.20.0/24) or where the initiating_process is identified as “ccmsetup.exe”, “ansible-playbook”, or “jenkins-agent”.
Scenario: Internal R&D and QA Environment Testing
- Context: The Quality Assurance (QA) team frequently tests new software builds in a sandboxed environment. These test files