ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the Unknown Loader campaign to establish persistence by executing malicious payloads identified through seven specific Indicators of Compromise (IOCs). Proactive hunting for these IOCs in Azure Sentinel is critical because early detection of this loader’s activity can prevent lateral movement and data exfiltration before the adversary fully embeds within the network.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 7 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown Loader
let malicious_ips = dynamic(["154.194.99.166"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.194.99.166"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["three.followfromapps.icu", "goto.followfromapps.icu", "blackkkkkdate.icu", "ps.blackkkkkdate.icu", "gtm-tracker.xyz", "tag-manager.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Intune/SCCM

  • Scenario: The Enterprise Security Team pushes a scheduled policy update or definition refresh to endpoint agents (e.g., CrowdStrike, SentinelOne, or Defender). These updates often download and execute temporary loader scripts that match the “Unknown Loader” IOCs before being signed by the vendor’s root CA.
  • Filter/Exclusion: Exclude network traffic and process executions originating from known management servers (e.g., *.intune.microsoft.com, sccm-server.internal) or specific service accounts (e.g., DOMAIN\SCCM_ServiceAccount) during standard maintenance windows (02:00–04:00 UTC).

• Third-Party Patch Management Execution

  • Scenario: Automated patch management tools like Ivanti, ManageEngine, or Chocolatey execute background jobs to download and stage patches for software like Adobe Acrobat, Java, or Chrome. These installers frequently utilize generic loader components that trigger the 7 IOCs associated with Unknown Loader before the final installation signature is verified.
  • Filter/Exclusion: Create a whitelist rule for processes located in specific vendor directories (e.g., C:\Program Files\Ivanti\, C:\ProgramData\Chocolatey\bin\) and exclude events where the parent process is identified as the patch management service executable (e.g., patchagent.exe, choco.exe).

• Scheduled PowerShell Script Execution for Compliance Audits

  • Scenario: IT Operations runs a daily compliance audit using PowerShell scripts hosted on a central file share. These scripts often invoke external loader modules to gather system telemetry or validate registry keys, generating network connections