This hunt targets the execution of known IOCs associated with the “Unknown Loader” malware, which adversaries use to establish initial footholds and facilitate further payload delivery. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised endpoints before the loader can execute its next-stage actions, such as credential theft or lateral movement, within the environment.
Malware Family: Unknown Loader Total IOCs: 12 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | ce9c1422af2c16af682eac479c3f9c57959beb355b22ba72de8c10c4078eb8db | payload | 2026-09-12 | 85% |
| sha256_hash | 7f47e02e297a35fabb1fb2a2e195e3dae5ff8ecfe7b201fed189d14e54124d2e | payload | 2026-09-12 | 85% |
| sha256_hash | 4df050c5944e523ac74ef5176a6100e018ebfc5ea5d0974707f5f92b0706cd74 | payload | 2026-09-12 | 95% |
| sha256_hash | b6789512189a639ead9dcb022ba3ea2533e31590f010e345add469abd4f93689 | payload | 2026-09-12 | 80% |
| sha256_hash | 99ad92674e2864792961995a1d27a3a5b105be9f9edfccc6694b3fa740ed30b1 | payload | 2026-09-12 | 85% |
| sha256_hash | daa967f000c233d278ec379d3f184283631ca60a7752b38bcf44c9741ea96f8b | payload | 2026-09-12 | 85% |
| sha256_hash | 9e8c9dfc881ce4185f7b3255faf7324042fbe04629c68ea1edd4de3a5a61b213 | payload | 2026-09-12 | 85% |
| sha256_hash | 4eff95566912a2032bc6aff7f0a830ca29f18d815068cfe4bd6240d0fb7b117e | payload | 2026-09-12 | 85% |
| sha256_hash | 89a8a8c7a1309cd74dd702718ecbfd094def6ec29b33a07b1b185cc808cc3512 | payload | 2026-09-12 | 80% |
| sha256_hash | dae91e9dee0f475223fbe4682ed4a22c2cd8a534d45574061ced9e0d2142d7e1 | payload | 2026-09-12 | 85% |
| sha256_hash | 0f716b1fc43724d89aab85ff69e9ed72004914454692b45778886001c47d2498 | payload | 2026-09-12 | 85% |
| sha256_hash | b2b706a940576bb6aa7112006aa38278e805737d3a55c7f0bd1dab381f1691fe | payload | 2026-09-12 | 80% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["ce9c1422af2c16af682eac479c3f9c57959beb355b22ba72de8c10c4078eb8db", "7f47e02e297a35fabb1fb2a2e195e3dae5ff8ecfe7b201fed189d14e54124d2e", "4df050c5944e523ac74ef5176a6100e018ebfc5ea5d0974707f5f92b0706cd74", "b6789512189a639ead9dcb022ba3ea2533e31590f010e345add469abd4f93689", "99ad92674e2864792961995a1d27a3a5b105be9f9edfccc6694b3fa740ed30b1", "daa967f000c233d278ec379d3f184283631ca60a7752b38bcf44c9741ea96f8b", "9e8c9dfc881ce4185f7b3255faf7324042fbe04629c68ea1edd4de3a5a61b213", "4eff95566912a2032bc6aff7f0a830ca29f18d815068cfe4bd6240d0fb7b117e", "89a8a8c7a1309cd74dd702718ecbfd094def6ec29b33a07b1b185cc808cc3512", "dae91e9dee0f475223fbe4682ed4a22c2cd8a534d45574061ced9e0d2142d7e1", "0f716b1fc43724d89aab85ff69e9ed72004914454692b45778886001c47d2498", "b2b706a940576bb6aa7112006aa38278e805737d3a55c7f0bd1dab381f1691fe"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses curl or wget to download a specific binary or script from a known internal artifact repository (e.g., Artifactory, Nexus) that happens to match one of the 12 IOCs (e.g., a specific SHA256 hash or URL path) used for a temporary build tool.
10.0.0.0/8) AND the destination domain is an internal artifact repository (e.g., *.artifactory.internal, *.nexus.internal). Alternatively, allowlist the specific SHA256 hash if the binary is signed by the corporate CA.Scenario: An IT administrator manually downloads a legacy support tool or diagnostic utility from a vendor’s public download page (e.g., downloads.vendor.com) that matches an IOC URL or hash, often because the vendor hasn’t updated their distribution links.
Domain Admins, IT_Support) AND the download occurs during business hours (9 AM – 5 PM local time). Additionally, check if the file is subsequently moved to a standard administrative directory (e.g., C:\AdminTools\ or C:\Support\).Scenario: A scheduled task or CI/CD pipeline (e.g., Jenkins, GitLab CI) pulls a dependency or build artifact from a public CDN or GitHub release that matches an IOC hash, particularly if the project uses an older version of a library known to be associated with the “Unknown Loader” campaign.
jenkins.exe, `gitlab-runner