ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior involving the execution of Unknown Loader components, which often serve as initial footholds for deploying additional payloads or establishing persistence within a network. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate and investigate potential early-stage compromises before they escalate into broader lateral movement or data exfiltration campaigns.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["planecorn.xyz", "waylace.xyz", "crateridge.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs detection rule, along with targeted filters and exclusions:

• Scenario: Enterprise Antivirus Engine Updates

  • Context: The organization’s endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled update of its definition database. This process often involves downloading new signature files via an unknown HTTP/S loader service that matches the “Unknown Loader” heuristic, triggering multiple IOCs for file creation and network connection.
  • Filter/Exclusion: Create a filter to exclude processes where ProcessName contains “MsMpEng.exe”, “Cfssvc.exe”, or “FalconSensorService.exe”. Additionally, add an exclusion for any network destination IP ranges belonging to the vendor’s update servers (e.g., 13.107.x.x for Microsoft).

• Scenario: Automated Patch Deployment via Configuration Management

  • Context: A scheduled job running on a central management server (e.g., SCCM/MECM or Ansible Tower) pushes a patch package to workstations. The deployment agent acts as an “Unknown Loader” when it extracts the payload and initiates the installation, generating IOCs for temporary file creation in %TEMP% and registry modifications that mimic loader behavior.
  • Filter/Exclusion: Exclude events where ProcessCommandLine contains keywords like “/install”, “/update”, or specific patch identifiers (e.g., “KB503xxx”). Furthermore, filter out activity originating from the specific service account used for deployment (e.g., DOMAIN\SCCM-Service-Account).

• Scenario: Third-Party SaaS Integration via Browser Extensions

  • Context: Users access cloud-based collaboration tools (e.g., Zoom, Teams, or Salesforce) which utilize background loader services to handle file