ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing the Unknown Loader to establish persistence and execute malicious payloads through three specific indicators of compromise within the Azure environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement or command-and-control activity before the loader fully integrates with existing endpoints.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["cacophonydiaphanous-acquiesce.xyz", "moonshadowforge.top", "timecommittee.space"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown Loader IOCs detection rule, tailored for an enterprise environment:

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: The IT operations team deploys a new version of a critical business application (e.g., Adobe Acrobat or Zoom) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes a custom installer (setup.exe) that downloads and executes a temporary loader script to unpack dependencies, generating network traffic matching the “Unknown Loader” IOCs.
  • Filter/Exclusion: Create an exclusion for the specific process path of the SCCM client service (C:\Program Files\Microsoft Configuration Manager\ccmexec.exe) or filter out network connections originating from the internal IP range of the Software Update Point servers during standard deployment windows (e.g., 02:00–04:00 local time).

• Scheduled Antivirus Definition Updates

  • Scenario: The organization’s endpoint protection suite, such as CrowdStrike Falcon or Symantec Endpoint Protection, runs a scheduled task to fetch the latest threat intelligence definitions. This process utilizes a background loader service (csfalcon.exe or Symantec Antivirus Loader) that establishes connections to external update servers, triggering the detection logic due to the dynamic nature of the downloaded signature files.
  • Filter/Exclusion: Exclude known antivirus vendor domains (e.g., *.crowdstrike.com, updates.symantec.com) and whitelist the specific hash values or process names associated with the primary EDR agent’s update service.

• PowerShell Administrative Automation Scripts

  • Scenario: A system administrator executes a scheduled PowerShell job (Task Scheduler -> Microsoft-Windows-TaskScheduler) to audit user permissions across Active Directory. The script uses Invoke-RestMethod or DownloadString