This rule detects the presence of known indicators of compromise associated with the “Unknown Loader,” a tool frequently used by adversaries to establish initial access or execute malicious payloads on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy loader activity that may have evaded real-time detection, enabling rapid containment before the adversary progresses to lateral movement or data exfiltration.
Malware Family: Unknown Loader Total IOCs: 116 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | trezenbold.com | payload_delivery | 2026-09-11 | 75% |
| domain | trustmark.uk.com | payload_delivery | 2026-09-11 | 75% |
| domain | tuitionservices.uk | payload_delivery | 2026-09-11 | 75% |
| domain | vetmarkett.com | payload_delivery | 2026-09-11 | 75% |
| domain | vinakors.com | payload_delivery | 2026-09-11 | 75% |
| domain | whitewaterexpresscarwash.com | payload_delivery | 2026-09-11 | 75% |
| domain | xclassyapparelsng.com | payload_delivery | 2026-09-11 | 75% |
| domain | yogajeany.com | payload_delivery | 2026-09-11 | 75% |
| domain | zahaki-clinic.com | payload_delivery | 2026-09-11 | 75% |
| domain | zamconstruction.com.au | payload_delivery | 2026-09-11 | 75% |
| domain | ptechnology.io | payload_delivery | 2026-09-11 | 75% |
| domain | pythonspo.com | payload_delivery | 2026-09-11 | 75% |
| domain | raiosolarenergy.com.br | payload_delivery | 2026-09-11 | 75% |
| domain | rawanflowers.com | payload_delivery | 2026-09-11 | 75% |
| domain | reynoldsplumbingandheating.co.uk | payload_delivery | 2026-09-11 | 75% |
| domain | roadtonight.com | payload_delivery | 2026-09-11 | 75% |
| domain | rootsstaffing.com | payload_delivery | 2026-09-11 | 75% |
| domain | rosek.net | payload_delivery | 2026-09-11 | 75% |
| domain | salaobrand.com | payload_delivery | 2026-09-11 | 75% |
| domain | sandfix.com | payload_delivery | 2026-09-11 | 75% |
| domain | schnittmuster-dongodesign.de | payload_delivery | 2026-09-11 | 75% |
| domain | science-and-spiritual-quest.org | payload_delivery | 2026-09-11 | 75% |
| domain | selfhelp.tech | payload_delivery | 2026-09-11 | 75% |
| domain | shaco-fc.com | payload_delivery | 2026-09-11 | 75% |
| domain | shaigoostudios.com | payload_delivery | 2026-09-11 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["trezenbold.com", "trustmark.uk.com", "tuitionservices.uk", "vetmarkett.com", "vinakors.com", "whitewaterexpresscarwash.com", "xclassyapparelsng.com", "yogajeany.com", "zahaki-clinic.com", "zamconstruction.com.au", "ptechnology.io", "pythonspo.com", "raiosolarenergy.com.br", "rawanflowers.com", "reynoldsplumbingandheating.co.uk", "roadtonight.com", "rootsstaffing.com", "rosek.net", "salaobrand.com", "sandfix.com", "schnittmuster-dongodesign.de", "science-and-spiritual-quest.org", "selfhelp.tech", "shaco-fc.com", "shaigoostudios.com", "stilhavuz.com", "suicidesurvivorguide.com", "svss.co.za", "swiftsense.co", "synaptixcol.com", "tc-jarun.com", "thiesconsulting.com", "traveluaehub.com", "loveinthelochs.com", "loveyourplace.com", "lucemia.cl", "magnoliamilestonesaba.com", "maisonmiki.com", "marielyresende.com", "mezin-avocat.fr", "monzato.com", "mplwood.com", "narkoz.com.tr", "nettsidehuset.no", "neuroalicante.es", "noveltyalliance.biz", "nsjuridicas.com", "nutrientesagro.com.br", "okstudio.com.ua", "onlyprint.pl"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
libcrypto.so or a custom loader.py script).
C:\Program Files\BuildTools\custom_loader\ or where the parent process is python.exe and the command line contains --build-mode=prod.jre_installer.exe) whose SHA-256 hash is in the ThreatFox IOC list due to historical reuse in other malware families.
jre_installer.exe and the parent process is powershell.exe with a scheduled task ID matching PatchLegacyJava.nmap or masscan) that bundles a helper binary with a hash collision against an IOC, often seen in CI/CD pipelines running on ephemeral containers.
sec-assessment-* or where the process path resides in /tmp/sec-tools/ and the user is svc-security.VeeamAgent or DatadogAgent) updates its core loader component, resulting in a new binary hash that coincidentally matches an IOC from the “Unknown Loader” set due to common compiler signatures or reused code blocks.