ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets the presence of eight specific IOCs linked to an unknown loader, which adversaries typically deploy to establish initial foothold and facilitate further payload execution. Proactively hunting for these indicators in Azure Sentinel is critical because detecting this loader early can prevent subsequent lateral movement and privilege escalation before the threat matures into a more complex intrusion.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 8 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`8aee7a413af09d4409da870471da4f6af7f93cae25e1837f8b34e170b0309cb8`	payload	2026-09-13	85%
sha256_hash	`b31c56eb8d0f9b3cc952cf7acb06edb9f2ad5def493087f25ce6c3a9c504c208`	payload	2026-09-13	85%
sha256_hash	`831759a2b305feaaa9faaa6672b0fe45130ad0bd23fe2c0d6f0e063448b83e0e`	payload	2026-09-13	85%
sha256_hash	`dbb1cd3ca4c63e484865ab5b3b1f6d3959d4e368e3836548c226fab5f07efdbf`	payload	2026-09-13	85%
sha256_hash	`b87c5c316e18095207279dfa929f5f7da5430072902792d54d00158e05616dcd`	payload	2026-09-13	85%
sha256_hash	`f6a89afd80bcfccc8ade155c0ef92a770de44610efdcac2b6a21650dc136dca5`	payload	2026-09-13	95%
sha256_hash	`463e71c114d5db041a864d58b729b4e38e2a285fa5edd92116a028ec83255cf9`	payload	2026-09-13	95%
sha256_hash	`156e06516c508cd609f3656d2b13786b0273598500018664e13861c43e5426bd`	payload	2026-09-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["8aee7a413af09d4409da870471da4f6af7f93cae25e1837f8b34e170b0309cb8", "b31c56eb8d0f9b3cc952cf7acb06edb9f2ad5def493087f25ce6c3a9c504c208", "831759a2b305feaaa9faaa6672b0fe45130ad0bd23fe2c0d6f0e063448b83e0e", "dbb1cd3ca4c63e484865ab5b3b1f6d3959d4e368e3836548c226fab5f07efdbf", "b87c5c316e18095207279dfa929f5f7da5430072902792d54d00158e05616dcd", "f6a89afd80bcfccc8ade155c0ef92a770de44610efdcac2b6a21650dc136dca5", "463e71c114d5db041a864d58b729b4e38e2a285fa5edd92116a028ec83255cf9", "156e06516c508cd609f3656d2b13786b0273598500018664e13861c43e5426bd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown Loader

False Positive Guidance

Legitimate Third-Party Software Updates: Automated update mechanisms for security tools (e.g., CrowdStrike Falcon, Carbon Black) or virtualization agents (e.g., VMware Tools, Hyper-V Integration Services) may download and execute loader binaries from vendor CDNs that match known ThreatFox IOCs.
- Filter/Exclusion: Exclude processes where the parent process is the specific updater service (e.g., falconctl.exe, cb.exe) and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\...).
Enterprise Backup and Recovery Agents: Backup software like Veeam, Acronis, or Commvault often uses lightweight loader executables to orchestrate data transfer or agent communication. These binaries may be signed but still match generic loader IOCs if the signature is not in the trusted allowlist.
- Filter/Exclusion: Exclude events where the image path contains Veeam, Acronis, or Commvault and the process is signed by the respective vendor’s certificate authority.
Scheduled Task Deployment via PowerShell: IT administrators frequently use schtasks or PowerShell’s Register-ScheduledTask to deploy configuration scripts or maintenance jobs. If the task action points to a temporary .exe or .dll loader in %TEMP% or %APPDATA%, it may trigger the rule.
- Filter/Exclusion: Exclude executions where the parent process is powershell.exe or schtasks.exe and the command line contains arguments related to task registration (e.g., /create, /change) or the path matches standard temp directories used by internal tooling.
Application Installer Bootstrappers: Installers for large enterprise applications (e.g., Microsoft Office, Adobe Creative Cloud, Java) often use a small bootstrap loader to extract and launch the