ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs linked to the Unknown Loader, a tool frequently used by adversaries to establish initial footholds and execute further payloads within Azure environments. Proactively hunting for these indicators allows the SOC team to identify compromised assets early, potentially disrupting the attacker’s ability to escalate privileges or move laterally before they achieve their full operational objectives.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["b28bdb3846a844a25300d1f595da9339cc8e5f830312d55bc15ffed6e2c0bd88", "de246468dde672b0802dacdb2f9d88434528ad091ffe5aab636e8b0358be5454"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) uses a custom classloader that dynamically loads bytecode from a temporary directory or JAR file, matching the memory mapping or file creation patterns of the “Unknown Loader” IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is a known Java VM (e.g., java.exe or jre bin path) and the loaded module resides in the application’s designated lib or temp directory.
• Scenario: Enterprise endpoint protection or EDR agents (such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint) inject their own loader libraries into monitored processes to track execution, creating transient memory regions or file handles that mimic loader behavior.
  • Filter/Exclusion: Exclude events where the source process is a known EDR/AV service executable (e.g., FalconSensor.exe, cb.exe, MsMpEng.exe) or where the thread belongs to a known EDR service account.
• Scenario: Development teams running .NET applications in debug mode using Visual Studio or Rider IDEs, where the CLR (Common Language Runtime) dynamically loads debug symbols or PDB files from network shares or local build artifacts, triggering file access or memory mapping alerts.
  • Filter/Exclusion: Exclude processes where the parent process is an IDE executable (e.g., devenv.exe, idea64.exe) and the accessed path contains standard build directories like bin, obj, or Debug.
• Scenario: Scheduled maintenance jobs using PowerShell or Python scripts to update internal tools, where the script dynamically imports modules from a shared network drive (SMB) or a local cache folder, causing the OS to map these files into memory in a manner similar to unknown loaders.
  • Filter/Exclusion: