This hunt targets the presence of known indicators of compromise associated with the “Unknown Loader” malware family, which is frequently used to establish initial footholds and execute subsequent payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the loader can fully establish persistence or deploy additional malicious components.
Malware Family: Unknown Loader Total IOCs: 123 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | upgrademycrib.com | payload_delivery | 2026-09-05 | 100% |
| domain | v-koolthailand.com | payload_delivery | 2026-09-05 | 100% |
| domain | veggiebell.in | payload_delivery | 2026-09-05 | 100% |
| domain | voluntariadoenmarruecos.org | payload_delivery | 2026-09-05 | 100% |
| domain | wolfieadventures.com | payload_delivery | 2026-09-05 | 100% |
| domain | wpmemberkit.com | payload_delivery | 2026-09-05 | 100% |
| domain | yogatree1dev.wpenginepowered.com | payload_delivery | 2026-09-05 | 100% |
| domain | zienixpropertyservices.com | payload_delivery | 2026-09-05 | 100% |
| domain | zizibreezi.com | payload_delivery | 2026-09-05 | 100% |
| domain | sparkpillars.com | payload_delivery | 2026-09-05 | 100% |
| domain | sprucegardenservices.com | payload_delivery | 2026-09-05 | 100% |
| domain | stratumrs.com | payload_delivery | 2026-09-05 | 100% |
| domain | sundiving.eu | payload_delivery | 2026-09-05 | 100% |
| domain | sunfoodsonline.com | payload_delivery | 2026-09-05 | 100% |
| domain | superiorindy.com | payload_delivery | 2026-09-05 | 100% |
| domain | symbology.wiki | payload_delivery | 2026-09-05 | 100% |
| domain | systemofthesovereign.com | payload_delivery | 2026-09-05 | 100% |
| domain | tan-pil.com | payload_delivery | 2026-09-05 | 100% |
| domain | theadacadvocacy.com | payload_delivery | 2026-09-05 | 100% |
| domain | thebluerosecircle.org | payload_delivery | 2026-09-05 | 100% |
| domain | thekingapproach.com | payload_delivery | 2026-09-05 | 100% |
| domain | thesalonbusiness.com | payload_delivery | 2026-09-05 | 100% |
| domain | theway.ae | payload_delivery | 2026-09-05 | 100% |
| domain | thewidowerskitchen.com | payload_delivery | 2026-09-05 | 100% |
| domain | thrivebeauty.co | payload_delivery | 2026-09-05 | 100% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["upgrademycrib.com", "v-koolthailand.com", "veggiebell.in", "voluntariadoenmarruecos.org", "wolfieadventures.com", "wpmemberkit.com", "yogatree1dev.wpenginepowered.com", "zienixpropertyservices.com", "zizibreezi.com", "sparkpillars.com", "sprucegardenservices.com", "stratumrs.com", "sundiving.eu", "sunfoodsonline.com", "superiorindy.com", "symbology.wiki", "systemofthesovereign.com", "tan-pil.com", "theadacadvocacy.com", "thebluerosecircle.org", "thekingapproach.com", "thesalonbusiness.com", "theway.ae", "thewidowerskitchen.com", "thrivebeauty.co", "tonybernardstudio.com", "torchandfluff.co.za", "travelindiadifferently.fr", "treekeepersllc.com", "tristatecounters.com", "tvmetabolic.com", "tzbarranch.com", "nobsnewshour.com", "oakspringsdental.com", "onmissionleaders.com", "ortusconsulting.co", "ovo.vodka", "pascalliguoriestategroup.com", "pixmarks.com", "pnhproductions.com", "prismspeechatx.com", "prosperovascular.com", "provacct.com", "quamtia.es", "redrockbenefits.com", "rfcert.com.br", "richmetcalfe.com", "romdigital.es", "rosswrites.com", "sailingservant.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new internal build artifact or container image using a CI/CD pipeline (e.g., Jenkins, GitLab CI) that includes a custom loader script or binary with a hash matching one of the 123 IOCs. This often happens when a shared utility library or a specific version of a loader tool (like ld.so variants or custom Go/Rust loaders) is reused across multiple projects.
jenkins-agent, gitlab-runner, azure-pipelines-agent) or where the executable path resides in standard build artifact directories (e.g., /opt/ci/artifacts/, C:\BuildAgent\work\).Scenario: An IT administrator runs a scheduled maintenance job using cron or Windows Task Scheduler to execute a proprietary backup or log rotation tool that uses a generic loader binary. If this tool was compiled from a source that shares a hash with a known ThreatFox IOC (due to common compiler flags or shared static libraries), it triggers the rule.
cron, crond, or Task Scheduler (svchost.exe for Windows tasks) and the executable name matches known internal tools (e.g., backup-loader, log-rotate-helper).Scenario: A security team performs a vulnerability assessment or penetration test using a tool like Metasploit or Nuclei, which may download and execute a small loader payload to test detection coverage. If the test payload’s hash matches one of the 123 IOCs, it generates a false positive during the testing window.