This detection identifies adversary activity involving the execution of unknown loader processes that match a curated set of 200 Indicators of Compromise (IOCs). Proactive hunting for these signatures in Azure Sentinel is critical to uncover early-stage command-and-control or fileless attacks that may evade standard signature-based defenses.
Malware Family: Unknown Loader Total IOCs: 200 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | wageandhourfirm.com | payload_delivery | 2026-08-28 | 100% |
| domain | viphomedesign.com | payload_delivery | 2026-08-28 | 100% |
| domain | visitcastelsaraceno.info | payload_delivery | 2026-08-28 | 100% |
| domain | vivaschool.es | payload_delivery | 2026-08-28 | 100% |
| domain | voicesystems.it | payload_delivery | 2026-08-28 | 100% |
| domain | vysoka-bd.cz | payload_delivery | 2026-08-28 | 100% |
| domain | veeble.it | payload_delivery | 2026-08-28 | 100% |
| domain | verlago.gr | payload_delivery | 2026-08-28 | 100% |
| domain | vespapizza.hu | payload_delivery | 2026-08-28 | 100% |
| domain | vethvordan.com | payload_delivery | 2026-08-28 | 100% |
| domain | vhncare.com | payload_delivery | 2026-08-28 | 100% |
| domain | viacatravel.com | payload_delivery | 2026-08-28 | 100% |
| domain | viadavid.nl | payload_delivery | 2026-08-28 | 100% |
| domain | viaexperience.com | payload_delivery | 2026-08-28 | 100% |
| domain | vinsidan.is | payload_delivery | 2026-08-28 | 100% |
| domain | uneautreattitude.fr | payload_delivery | 2026-08-28 | 100% |
| domain | unicascomotu.com | payload_delivery | 2026-08-28 | 100% |
| domain | unleashed.gr | payload_delivery | 2026-08-28 | 100% |
| domain | upf-shop.com | payload_delivery | 2026-08-28 | 100% |
| domain | urban-ks.com | payload_delivery | 2026-08-28 | 100% |
| domain | uwebbztechnology.com | payload_delivery | 2026-08-28 | 100% |
| domain | vaips.net | payload_delivery | 2026-08-28 | 100% |
| domain | valedinossauros.com.br | payload_delivery | 2026-08-28 | 100% |
| domain | vandengaart.com | payload_delivery | 2026-08-28 | 100% |
| domain | vapestoreau.com | payload_delivery | 2026-08-28 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["wageandhourfirm.com", "viphomedesign.com", "visitcastelsaraceno.info", "vivaschool.es", "voicesystems.it", "vysoka-bd.cz", "veeble.it", "verlago.gr", "vespapizza.hu", "vethvordan.com", "vhncare.com", "viacatravel.com", "viadavid.nl", "viaexperience.com", "vinsidan.is", "uneautreattitude.fr", "unicascomotu.com", "unleashed.gr", "upf-shop.com", "urban-ks.com", "uwebbztechnology.com", "vaips.net", "valedinossauros.com.br", "vandengaart.com", "vapestoreau.com", "tsnv.de", "tungkechuyencuoi.com", "turkishindirim.com", "ufabetufabet.org", "umen.es", "unddsglobalco.com", "tosanstore.com", "tpronails.com", "tracktec.cl", "transparenz-radar.org", "trenchsniper.fun", "trendigtjustnu.se", "thethinkubator.org", "tjbowden.com.au", "toddlermealideas.com", "tommyrobitaille.com", "topshelfexperts.com", "th-gw.com", "thebraslavskys.com", "thehomestore-parsons.com", "thelastreformation.co.uk", "thepremere.com", "theresewalsh.com", "thermomixbrasil.com.br", "telusnetwork.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown Loader IOCs detection rule:
Scenario: Endpoint Protection Agent Self-Updates
ProcessName matches known security agents (e.g., Cns.exe, MsMpEng.exe, SentinelOneAgent.exe) AND the ParentProcessName is the agent’s service host, or filter by specific trusted update URLs in the network traffic logs.Scenario: Scheduled PowerShell Deployment Scripts
powershell.exe) to deploy configuration scripts or software patches across the enterprise. These scripts frequently invoke temporary loader modules or download manifests from internal repositories, which may appear as unknown IOCs if the script repository is not whitelisted in ThreatFox.ProcessCommandLine contains keywords like “Update,” “Deploy,” or “Patch” AND the UserAccount belongs to the domain admin group (e.g., DOMAIN\IT-Admins) during business hours (08:00–18:00).Scenario: Microsoft Office 365 Click-to-Run Updates
OfficeClickToRun.exe) runs continuously in the background to manage application updates. It frequently spawns temporary loader processes to fetch and