This rule detects the presence of known indicators of compromise associated with the Unknown Loader, a malicious component frequently used to establish initial footholds or execute secondary payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the loader can fully execute its payload, thereby reducing the mean time to detection and limiting the potential impact of this high-severity threat.
Malware Family: Unknown Loader Total IOCs: 177 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | zfsinlimite.xyz | payload_delivery | 2026-09-10 | 75% |
| domain | xn--80aeeebt5a0ahee.xn--p1ai | payload_delivery | 2026-09-10 | 75% |
| domain | xn--iglesiadelacompaia-20b.com | payload_delivery | 2026-09-10 | 75% |
| domain | xpensebuddy.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.transporteur-tunisie.tn | payload_delivery | 2026-09-10 | 75% |
| domain | www.truearttattoos.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.ventodejeri.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.vgavoile.org | payload_delivery | 2026-09-10 | 75% |
| domain | www.vitatrasporti.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.sxgxhc.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.tablebio.be | payload_delivery | 2026-09-10 | 75% |
| domain | www.taliaelavaligiadelleidee.co.uk | payload_delivery | 2026-09-10 | 75% |
| domain | www.tempomilitare.it | payload_delivery | 2026-09-10 | 75% |
| domain | www.terravivaproject.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.smpn2cianjur.sch.id | payload_delivery | 2026-09-10 | 75% |
| domain | www.spanishlessonslosangeles.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.spudu.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.stakles.eu | payload_delivery | 2026-09-10 | 75% |
| domain | www.startacquiring.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.storiedipremier.it | payload_delivery | 2026-09-10 | 75% |
| domain | www.studiomassimobellomo.it | payload_delivery | 2026-09-10 | 75% |
| domain | www.superscoresat.com | payload_delivery | 2026-09-10 | 75% |
| domain | www.rubencabanillas.site | payload_delivery | 2026-09-10 | 75% |
| domain | www.sabrinamartone.it | payload_delivery | 2026-09-10 | 75% |
| domain | www.saglikliannebebek.com | payload_delivery | 2026-09-10 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["zfsinlimite.xyz", "xn--80aeeebt5a0ahee.xn--p1ai", "xn--iglesiadelacompaia-20b.com", "xpensebuddy.com", "www.transporteur-tunisie.tn", "www.truearttattoos.com", "www.ventodejeri.com", "www.vgavoile.org", "www.vitatrasporti.com", "www.sxgxhc.com", "www.tablebio.be", "www.taliaelavaligiadelleidee.co.uk", "www.tempomilitare.it", "www.terravivaproject.com", "www.smpn2cianjur.sch.id", "www.spanishlessonslosangeles.com", "www.spudu.com", "www.stakles.eu", "www.startacquiring.com", "www.storiedipremier.it", "www.studiomassimobellomo.it", "www.superscoresat.com", "www.rubencabanillas.site", "www.sabrinamartone.it", "www.saglikliannebebek.com", "www.sculptlandscapes.com", "www.segnaleradio.net", "www.silbersee-bob.de", "www.siyakhatalasafety.co.za", "www.sjhomesfinder.com", "www.portailpme.fr", "www.qnapoker.com", "www.rarzar.com", "www.repausetoisurmoi.fr", "www.rh-dienstleistung.de", "www.perthroadside.com.au", "www.pokertalkshow.com", "www.my-skin21.fr", "www.naspychare.cz", "www.nicholasbridger.co.uk", "www.norbertoconfalonieri.com", "www.nrcare.co.uk", "www.operatorsguiden.se", "www.organikscarf.com", "www.medium-telepatico.com", "www.mersinsanatedebiyat.com", "www.methodistpreschool.org", "www.metronominee.com", "www.michellengome.com", "www.monguidesenior.fr"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
jq, curl, or custom Python wheels) from internal artifact repositories (like JFrog Artifactory or Nexus) which may match the “Unknown Loader” hash or path patterns.
ansible-playbook.exe, terraform.exe, or python.exe and the working directory is within a known CI/CD workspace (e.g., C:\ci\builds\ or D:\terraform\).%TEMP% or %ProgramData% and matches one of the 177 IOCs due to generic naming or hash collisions.
MsMpEng.exe (Defender) or FalconSensor.exe (CrowdStrike) and the file path contains \Microsoft\Windows Defender\ or \CrowdStrike\.powershell.exe or pwsh.exe and the command line contains keywords like -Install, -Update, or specific vendor names (tomcat, nginx), and the file path is under C:\Temp\ or