ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection targets adversary behavior involving the execution of unknown loader processes that may indicate early-stage malware staging or command-and-control communication. Proactively hunting for these indicators in Azure Sentinel is critical to identify and isolate potential threats before they escalate into full-blown incidents within the enterprise environment.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["forecast-chaos.com", "sound-obstacle.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, along with suggested filters or exclusions tailored for an enterprise environment:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune frequently pushes new application installers (.msi/.exe) to endpoints. These packages often include signed but previously unseen loader components that extract payloads before installation, triggering the “Unknown Loader” heuristic.
  • Filter/Exclusion: Create a detection exclusion for processes spawned by ccmsetup.exe (SCCM) or Microsoft.IntuneManagementExtension.exe. Additionally, filter out any IOCs where the parent process is running under the SYSTEM account and the file path resides within the standard deployment directories (e.g., C:\Windows\CCM\ or C:\ProgramData\Microsoft\Intune Management Extension).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise antivirus solutions like Microsoft Defender for Endpoint, Symantec Endpoint Protection, or CrowdStrike perform scheduled definition updates. The update mechanism often utilizes a temporary loader process to download and unpack new signature databases before the main engine reloads them, mimicking an unknown loader behavior.
  • Filter/Exclusion: Exclude IOCs where the executable name matches known AV update loaders (e.g., MpCmdRun.exe, Symantec Antivirus Update Service, or C-Service.exe) and the file hash is part of a trusted “Known Good” list maintained in the SIEM. A time-based filter can also be applied to exclude events occurring during standard maintenance windows (e.g., 02:00–04:00 AM).

• Scenario: Third-Party Patch Management Tools

  • Context: Tools such as