ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt targets the presence of seven specific IOCs linked to an unidentified malware strain, which may indicate an active compromise or a stealthy initial access vector within the environment. Proactively hunting for these indicators in Azure Sentinel is critical to identify and isolate affected assets before the unknown malware can establish persistence, exfiltrate data, or pivot to other systems.

IOC Summary

Malware Family: Unknown malware Total IOCs: 7 IOC Types: ip:port, sha256_hash, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["102.117.163.68", "217.216.34.133", "3.110.54.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.117.163.68", "217.216.34.133", "3.110.54.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://studiokasa.com.br/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["79a40766ab58027817db28412d600be9f3e64f8e24133562cc3aacb500ec720a", "9db1f0f3fbaabb644021c1d872619ad53ade664f8b9794bb9b64fda013f93798", "10cf2e3f52b5daee5ee47fb639a17003f019a3d8f9d0c0fc8fdfbcc71ff88453"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A security engineer manually deploys a new version of an endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) via a Configuration Manager (SCCM) or Intune policy, which temporarily creates a unique hash or file pattern that matches one of the “Unknown” IOCs before the threat intelligence feed updates.

  • Filter/Exclusion: Exclude alerts where the source process is a known configuration management agent (e.g., ccmexec.exe, IntuneAgent.exe) or where the file path resides in standard software deployment directories (e.g., C:\Program Files (x86)\Microsoft Configuration Manager\).

• Scenario: An IT administrator runs a legitimate but obscure third-party utility (such as a specific version of 7-Zip, WinRAR, or a niche database backup tool like pg_dump) that has a known, benign hash collision or a newly compiled binary that hasn’t yet been whitelisted in the threat intelligence database.

  • Filter/Exclusion: Exclude alerts for files located in standard application installation paths (e.g., C:\Program Files\, C:\Program Files (x86)\) or exclude specific known-good hashes for common administrative tools if the IOC is hash-based.

• Scenario: A scheduled task for a legacy application (e.g., a custom internal reporting tool or an old Java-based middleware) executes a script or binary that generates a temporary file with a hash matching an “Unknown” IOC, often due to the binary being recompiled for a specific OS architecture without updating the threat feed.

  • Filter/Exclusion: Exclude alerts where the parent process is a known scheduler service (e.g., TaskScheduler.exe, schtasks.exe) or where the file path is within a specific legacy application directory (e.g., C:\LegacyApps\Reports\).