← Back to SOC feed Coverage →

ThreatFox: Unknown Loader IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocthreatfoxunknown_loader
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-08-23T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of unknown loader processes that match known ThreatFox indicators, signaling potential initial access or command-and-control activity from a sophisticated threat actor. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify and contain early-stage compromises before they escalate into full-blown incidents, given the high severity associated with this specific loader family.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 63 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainzoznam.wikipayload_delivery2026-08-23100%
domainunifyz.compayload_delivery2026-08-23100%
domainviagginelfirmamento.itpayload_delivery2026-08-23100%
domainvilla-bonna.frpayload_delivery2026-08-23100%
domainwebmoda.netpayload_delivery2026-08-23100%
domainwestcoastpb.co.zapayload_delivery2026-08-23100%
domainwingroup.inpayload_delivery2026-08-23100%
domainwpbinarymlm.compayload_delivery2026-08-23100%
domainxiaotiao.storepayload_delivery2026-08-23100%
domainxn--42caa2e9bqo5d1azsb3r7c.compayload_delivery2026-08-23100%
domainzepik.depayload_delivery2026-08-23100%
domainthefactsroom.compayload_delivery2026-08-23100%
domainthrive-moodle.compayload_delivery2026-08-23100%
domaintmlaboratory.gepayload_delivery2026-08-23100%
domaintolifestyles.compayload_delivery2026-08-23100%
domaintoluene.rupayload_delivery2026-08-23100%
domaintpienterprises.compayload_delivery2026-08-23100%
domaintraqwords.compayload_delivery2026-08-23100%
domaintregflix.compayload_delivery2026-08-23100%
domaintsv-oftersheim.depayload_delivery2026-08-23100%
domainttl-eg.compayload_delivery2026-08-23100%
domaintunapamplona.espayload_delivery2026-08-23100%
domainstore.relexa.uspayload_delivery2026-08-23100%
domainstoryboothmedia.compayload_delivery2026-08-23100%
domainstudioluglio.compayload_delivery2026-08-23100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["zoznam.wiki", "unifyz.com", "viagginelfirmamento.it", "villa-bonna.fr", "webmoda.net", "westcoastpb.co.za", "wingroup.in", "wpbinarymlm.com", "xiaotiao.store", "xn--42caa2e9bqo5d1azsb3r7c.com", "zepik.de", "thefactsroom.com", "thrive-moodle.com", "tmlaboratory.ge", "tolifestyles.com", "toluene.ru", "tpienterprises.com", "traqwords.com", "tregflix.com", "tsv-oftersheim.de", "ttl-eg.com", "tunapamplona.es", "store.relexa.us", "storyboothmedia.com", "studioluglio.com", "sudershanchakra.com", "suhaocanh.com", "sure.marketing", "taqpump.com", "teatrobolivar.com", "techlinksystems.com", "techvienna.com", "textilemerchandising.com", "theactionbrokers.com", "thedoocrewhouston.com", "simplesfrescas.pt", "smartsing.es", "smkmuhsala3.sch.id", "solar-signage.com", "soswordpressitalia.com", "spinksolutions.com", "sporjouma.com", "sportmiguelangelcampos.com", "starkdurchstarten.de", "salzschatz.de", "sambazoil.com", "sandbeach.co.uk", "sante-redox.fr", "serrurierlux.fr", "shadowcreative.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Unknown Loader IOCs detection rule in an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/unknown_loader/