ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing the Unknown Loader framework to execute initial command-and-control communications or payload delivery via specific network indicators of compromise (IOCs). Proactive hunting for these five IOCs within Azure Sentinel is critical to identify early-stage lateral movement and potential data exfiltration before the malware fully establishes persistence on endpoints.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 5 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["cleardig477.icu", "superfirewallprotection.com", "moderncloudprotection.com", "publicwebprotection.com", "pageimagebook.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, along with targeted filters and exclusions tailored for an enterprise environment:

• Scheduled Software Updates via WSUS or SCCM

  • Scenario: The Windows Update Agent (wuauclt.exe) or Microsoft Endpoint Configuration Manager (SCCM) client initiates a background download of a large patch package. This process often spawns temporary child processes that load dynamic libraries or scripts, matching the “Unknown Loader” behavior and generating multiple IOCs related to file creation and network connections in the C:\Windows\SoftwareDistribution directory.
  • Filter/Exclusion: Create an exclusion rule for parent processes named wuauclt.exe, ccmexec.exe, or WuaUerWorker.exe. Additionally, exclude file paths containing \SoftwareDistribution\Download\ and network connections to Microsoft Update IP ranges (e.g., 13.107.x.x).

• Enterprise Antivirus Real-Time Scanning

  • Scenario: During peak business hours, the enterprise endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Symantec Endpoint Protection) performs a deep scan of recently modified user documents. The scanner’s loader component (csfalcon.exe, s1agent.exe) dynamically loads heuristic engines and signature databases, triggering IOCs that mimic the “Unknown Loader” pattern due to rapid file enumeration and memory mapping activities.
  • Filter/Exclusion: Exclude known security vendor executables by name (e.g., csfalcon.exe, S1Agent.exe, Symantec Antivirus.exe). Further refine by excluding network traffic destined for the vendor’s cloud management endpoints (e.g., CrowdStrike Cloud IPs) and file paths within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).