ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This rule identifies the execution of known loader binaries associated with the ThreatFox threat intelligence feed, indicating that an adversary is likely establishing a foothold to facilitate further malicious activity. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect and isolate compromised endpoints before the loader can download additional payloads or escalate privileges.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 12 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["docssend.icu", "mharsborsteel.com", "www.technicalauthentications.live", "panelcoreapp.xyz", "workingrectorys.xyz", "privatetoken.cc", "ericphotography.cc", "kliearthmover.com", "www.loqinmicofstloine.icu", "hook-relay.xyz", "sharepoint-document-verification.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["http://http://85.209.87.73/login"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A legacy Java application server (e.g., Tomcat or JBoss) executes a custom java -jar command to load a proprietary plugin or update module from a network share or local disk, where the process name or path matches a known “unknown loader” hash or pattern from the ThreatFox feed.
  • Filter/Exclusion: Exclude processes where the parent process is java.exe or javaw.exe and the command line contains -jar or -cp, specifically for known application server directories (e.g., C:\Program Files\Apache Tomcat\bin\).
• Scenario: An enterprise endpoint DLP or EDR agent (e.g., CrowdStrike Falcon, Carbon Black, or Zscaler) spawns a helper process or uses a generic loader binary to stage or update its own rule sets or plugins, triggering the detection due to the binary’s reputation or path.
  • Filter/Exclusion: Exclude processes originating from specific vendor directories (e.g., C:\ProgramData\CrowdStrike\, C:\Program Files\Zscaler\) or where the parent process is the main agent executable (e.g., FalconSensor.exe, zscaler.exe).
• Scenario: A scheduled maintenance job (e.g., Task Scheduler or cron) runs a PowerShell script or a small .exe wrapper to invoke a .NET assembly (e.g., csc.exe or a custom loader.exe) for database backup validation or log rotation, which is not whitelisted in the IOC feed.
  • Filter/Exclusion: Exclude processes where the parent process is svchost.exe (specifically the Task Scheduler service) or powershell.exe invoked by a known scheduled task name (e.g., *Backup*, *LogRotation*), and the working directory