This hunt hypothesis targets adversary behavior where malicious actors deploy the Unknown Loader to establish persistence and execute payloads via specific file hashes and network indicators within the Azure environment. Proactively hunting for these 24 IOCs in Azure Sentinel is critical because Unknown Loader often serves as an initial foothold that can evade standard signature-based detection, allowing attackers to pivot laterally before triggering broader alerts.
Malware Family: Unknown Loader Total IOCs: 24 IOC Types: domain, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://mdsearch.xyz/plg | botnet_cc | 2026-07-07 | 100% |
| url | hxxps://mdsearch.xyz/usa | botnet_cc | 2026-07-07 | 100% |
| domain | runbattle.space | botnet_cc | 2026-07-07 | 100% |
| domain | ironsize.cfd | botnet_cc | 2026-07-07 | 100% |
| url | hxxps://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o | botnet_cc | 2026-07-07 | 100% |
| url | hxxps://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x | botnet_cc | 2026-07-07 | 100% |
| url | hxxps://activityof.com/datei | botnet_cc | 2026-07-07 | 100% |
| url | hxxps://bnsbackend.mydevsystems.com/redirect | botnet_cc | 2026-07-07 | 100% |
| domain | amexhighyieldsavings.online | payload_delivery | 2026-07-07 | 75% |
| domain | bayramogluplaji.com | payload_delivery | 2026-07-07 | 75% |
| domain | bjsfeedback.online | payload_delivery | 2026-07-07 | 75% |
| domain | churchschickenfeedback.pro | payload_delivery | 2026-07-07 | 75% |
| domain | fintops.info | payload_delivery | 2026-07-07 | 75% |
| domain | hayvavillage.com | payload_delivery | 2026-07-07 | 75% |
| domain | homedpotcomsurvey.shop | payload_delivery | 2026-07-07 | 75% |
| domain | jifwc.com | payload_delivery | 2026-07-07 | 75% |
| domain | josellinfiverr.online | payload_delivery | 2026-07-07 | 75% |
| domain | lhsconstrutora.com | payload_delivery | 2026-07-07 | 75% |
| domain | mygreatlekes.pro | payload_delivery | 2026-07-07 | 75% |
| domain | pollolistens.store | payload_delivery | 2026-07-07 | 75% |
| domain | talktoregall.site | payload_delivery | 2026-07-07 | 75% |
| domain | tellthebellsurvey.store | payload_delivery | 2026-07-07 | 75% |
| domain | theintelligentwomen.com | payload_delivery | 2026-07-07 | 75% |
| domain | valuevillagelistenssurvey.cfd | payload_delivery | 2026-07-07 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["runbattle.space", "ironsize.cfd", "amexhighyieldsavings.online", "bayramogluplaji.com", "bjsfeedback.online", "churchschickenfeedback.pro", "fintops.info", "hayvavillage.com", "homedpotcomsurvey.shop", "jifwc.com", "josellinfiverr.online", "lhsconstrutora.com", "mygreatlekes.pro", "pollolistens.store", "talktoregall.site", "tellthebellsurvey.store", "theintelligentwomen.com", "valuevillagelistenssurvey.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["https://mdsearch.xyz/plg", "https://mdsearch.xyz/usa", "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "https://activityof.com/datei", "https://bnsbackend.mydevsystems.com/redirect"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are four specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, including targeted filters and exclusions to reduce noise in an enterprise environment:
Antivirus Definition Updates via Microsoft Defender for Endpoint
MpCmdRun.exe or MsMpEng.exe loader. If the specific hash of the temporary loader component used during this update cycle is not yet in the ThreatFox whitelist, it will match the “Unknown Loader” IOCs despite being a trusted vendor process.MsMpEng.exe and MpCmdRun.exe originating from the %ProgramFiles%\Windows Defender\Antivirus\ directory, specifically when the network destination is Microsoft Update servers (*.update.microsoft.com).Software Deployment via SCCM (System Center Configuration Manager)
ccmexec.exe) executes application deployments. This often involves a temporary loader process extracting and installing packages from internal repositories. If the deployment package utilizes a custom installer wrapper that hasn’t been scanned by ThreatFox yet, it will generate alerts for the unknown loader hash.ccmexec.exe (or SCCMClientService) and the file path contains \SoftwareDistribution\Download\ or \CCMCache\. Additionally, filter out IOCs originating from internal IP subnets designated for the Software Distribution Point.Automated Patch Management with WSUS or Ivanti