This rule detects the presence of 121 IOCs linked to the Unknown Loader, a tool frequently used by adversaries to establish initial footholds and execute malicious payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to identify compromised assets early, preventing the loader from progressing to more advanced stages of the kill chain such as privilege escalation or lateral movement.
Malware Family: Unknown Loader Total IOCs: 121 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | zulfija.blog | payload_delivery | 2026-09-15 | 75% |
| domain | zus.cz | payload_delivery | 2026-09-15 | 75% |
| domain | zukunfthandel.saarland | payload_delivery | 2026-09-15 | 75% |
| domain | yayed.org.tr | payload_delivery | 2026-09-15 | 75% |
| domain | yb-lawyers.com | payload_delivery | 2026-09-15 | 75% |
| domain | yiddishpourtous.org | payload_delivery | 2026-09-15 | 75% |
| domain | yourjoyfulpath.com | payload_delivery | 2026-09-15 | 75% |
| domain | yourskindoctors.co.uk | payload_delivery | 2026-09-15 | 75% |
| domain | yvonnehalsamassage.se | payload_delivery | 2026-09-15 | 75% |
| domain | zabdesign.pl | payload_delivery | 2026-09-15 | 75% |
| domain | zahledebate.com | payload_delivery | 2026-09-15 | 75% |
| domain | zarazyasg.com | payload_delivery | 2026-09-15 | 75% |
| domain | zasoph.com.mx | payload_delivery | 2026-09-15 | 75% |
| domain | zeelvis-it.nl | payload_delivery | 2026-09-15 | 75% |
| domain | zeitnahsurvey.com | payload_delivery | 2026-09-15 | 75% |
| domain | zero1engenharia.com.br | payload_delivery | 2026-09-15 | 75% |
| domain | zsblatec.cz | payload_delivery | 2026-09-15 | 75% |
| domain | wholesaleitalia.it | payload_delivery | 2026-09-15 | 75% |
| domain | wiba-gest.com | payload_delivery | 2026-09-15 | 75% |
| domain | wico-pro.de | payload_delivery | 2026-09-15 | 75% |
| domain | windel-eimer.de | payload_delivery | 2026-09-15 | 75% |
| domain | wirtschaftspruefungkampmann.de | payload_delivery | 2026-09-15 | 75% |
| domain | wisemans.org.au | payload_delivery | 2026-09-15 | 75% |
| domain | wizardlu.fun | payload_delivery | 2026-09-15 | 75% |
| domain | wmsss.co.uk | payload_delivery | 2026-09-15 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["zulfija.blog", "zus.cz", "zukunfthandel.saarland", "yayed.org.tr", "yb-lawyers.com", "yiddishpourtous.org", "yourjoyfulpath.com", "yourskindoctors.co.uk", "yvonnehalsamassage.se", "zabdesign.pl", "zahledebate.com", "zarazyasg.com", "zasoph.com.mx", "zeelvis-it.nl", "zeitnahsurvey.com", "zero1engenharia.com.br", "zsblatec.cz", "wholesaleitalia.it", "wiba-gest.com", "wico-pro.de", "windel-eimer.de", "wirtschaftspruefungkampmann.de", "wisemans.org.au", "wizardlu.fun", "wmsss.co.uk", "woodendeco.shop", "woodhannalaw.com", "xn--22c0bp5add8ax1exhua.com", "xn--glienickerbrcke-bwb.de", "xn--glsneranlgsservice-pubh.dk", "xn--steuerbro-mauche-pzb.de", "xtremsudcanyon.com", "wapsglobal.com", "warneravephysio.com.au", "washingtontowels.com", "wassergeister.com", "waterflosserguide.com", "wave4pet.com", "wearpartsindia.com", "weashop.com", "wecodeexist.com", "weeklysadakalo.us", "welovejazzed.com", "weshipedia.fr", "westernindiaforgings.com", "westlakefootballfoundation.com", "westvillagedev.com", "wevza.com", "vesselonthevessel.org", "vibrantholidaysafaris.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
%TEMP%, %LOCALAPPDATA%) or system paths that match the specific file hashes or paths associated with the Unknown Loader.
MsMpEng.exe (Defender), FalconSensor.exe (CrowdStrike), or SentinelOne.exe, or where the file path contains \Quarantine\ or \Cache\.AdobeUpdateService.exe, SlackUpdater.exe) that may download and execute loader-like binaries in temporary directories to patch the application.
C:\Program Files\Adobe\Adobe Creative Cloud\ACC\ or %LOCALAPPDATA%\Zoom\).svchost.exe (specifically the Task Scheduler service) or where the command line contains keywords like rotat, clean, archive, or compress.npm, yarn, webpack) may generate temporary loader scripts or binary artifacts in project directories or global cache folders during compilation or dependency installation.