ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection rule identifies potential initial access or command-and-control activity by flagging network traffic matching known indicators of compromise from the ThreatFox Unknown Loader campaign. A proactive hunt is essential within Azure Sentinel to rapidly isolate affected endpoints and prevent lateral movement before this loader establishes persistence on critical systems.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["quiltdress.xyz", "basinhook.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown Loader IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Patching via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: The SCCM client service (ccmexec.exe) frequently downloads and executes unknown loader scripts or temporary executables during scheduled patch deployment windows to install updates. These often generate new IOCs that the rule flags as “unknown” because they are dynamic in nature.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name ccmexec.exe and restrict the detection window to exclude standard maintenance hours (e.g., 02:00–06:00 local time). Additionally, whitelist IOCs where the file hash matches known SCCM content libraries.

• Scenario: Scheduled Antivirus Definition Updates via CrowdStrike Falcon

  • Context: The CrowdStrike sensor (csagent.exe) or its associated loader process periodically fetches new definition packages from the cloud. These updates often manifest as temporary loader executables with evolving hashes that trigger the “Unknown Loader” logic before being fully cataloged in the threat intelligence feed.
  • Suggested Filter/Exclusion: Exclude events where the process path contains \Program Files\CrowdStrike\ and the file extension is .dll or .cab. Implement a time-based suppression for the first 15 minutes following the daily update cycle (typically triggered at 03:00 UTC).

• Scenario: PowerShell Script Execution by DevOps CI/CD Pipelines

  • Context: Internal Jenkins or Azure DevOps agents execute deployment scripts using powershell.exe to load custom configuration modules. These scripts often invoke temporary loader processes that are not yet present in the global IOC database, causing legitimate deployment activities to be