This hunt targets adversary behavior where unknown malware introduces new Indicators of Compromise (IOCs) that bypass existing signature-based defenses within the Azure Sentinel environment. Proactively hunting for these 39 specific IOCs is critical to identify early-stage infections and reduce dwell time before the malware can establish persistence or exfiltrate sensitive data.
Malware Family: Unknown malware Total IOCs: 39 IOC Types: domain, url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | abrmot.pro | payload_delivery | 2026-07-09 | 100% |
| ip:port | 47[.]86[.]97[.]42:80 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 47[.]86[.]97[.]42:8080 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 47[.]109[.]190[.]151:8080 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 47[.]86[.]97[.]42:443 | botnet_cc | 2026-07-09 | 100% |
| domain | huishuvish.cc | payload_delivery | 2026-07-09 | 100% |
| domain | pluhabovra.info | payload_delivery | 2026-07-09 | 100% |
| ip:port | 176[.]9[.]54[.]156:443 | payload_delivery | 2026-07-09 | 100% |
| domain | hilacbatoriaaa.cc | payload_delivery | 2026-07-09 | 100% |
| ip:port | 47[.]109[.]190[.]151:443 | botnet_cc | 2026-07-09 | 100% |
| ip:port | 179[.]43[.]149[.]252:443 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 179[.]43[.]149[.]251:443 | botnet_cc | 2026-07-09 | 75% |
| url | hxxp://95[.]217[.]38[.]238/ws/agent | botnet_cc | 2026-07-09 | 100% |
| url | hxxps://joanpowerslaw.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://tennistotal.net/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://turuncukentmobilyalari.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://triangleadvocacia.es/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://proroyalty.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://teknofestdronesampiyonasi.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://mediaintegra.co.id/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://www.tais-costruzioni.it/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://populardentalcare.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://notarymatrixinc.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://ilovebeaver.com/ | payload_delivery | 2026-07-09 | 90% |
| url | hxxps://www.kilimanjarodreams.com/ | payload_delivery | 2026-07-09 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["179.43.149.251", "47.109.190.151", "47.86.97.42", "179.43.149.252", "176.9.54.156"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["179.43.149.251", "47.109.190.151", "47.86.97.42", "179.43.149.252", "176.9.54.156"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["abrmot.pro", "huishuvish.cc", "pluhabovra.info", "hilacbatoriaaa.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://95.217.38.238/ws/agent", "https://joanpowerslaw.com/", "https://tennistotal.net/", "https://turuncukentmobilyalari.com/", "https://triangleadvocacia.es/", "https://proroyalty.com/", "https://teknofestdronesampiyonasi.com/", "https://mediaintegra.co.id/", "https://www.tais-costruzioni.it/", "https://populardentalcare.com/", "https://notarymatrixinc.com/", "https://ilovebeaver.com/", "https://www.kilimanjarodreams.com/", "https://londonhomeguide.co.uk/", "https://laguzmancontinta.com/", "https://abbasheartwm.org/", "https://gotomariko.com/", "https://finsightsconsulting.com/", "https://danacgautreaux.net/", "https://www.sbss.org.in/", "https://childrenhouseschool.com/", "https://alessiachloeperu.com.pe/", "https://boxywebtools.com/", "https://adiapavj.ro/", "https://bartonspecialistclinic.com.au/", "https://abrmot.pro/", "https://healthfood.zone/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, tailored for an enterprise environment:
Endpoint Protection Signature Updates via SCCM
mpexec.exe or custom .msi wrappers) that generate network connections to the vendor’s update servers, matching the “Unknown malware” IOCs in the ThreatFox package before the signatures are fully indexed locally.10.x.x.x) and destination ports associated with the specific vendor’s update servers (e.g., *.update.microsoft.com or *.symantec.com). Additionally, exclude process hashes known to belong to the SCCM client service (ccmexec.exe).Scheduled Patch Management Deployments
svc_patch_deploy).Enterprise Backup Agent Operations