ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential compromise by correlating eight distinct indicators of unknown malware activity across the Azure Sentinel environment. Proactive hunting is critical to rapidly isolate these emerging threats before they establish persistence or exfiltrate sensitive data, given their high severity and lack of established signatures.

IOC Summary

Malware Family: Unknown malware Total IOCs: 8 IOC Types: ip:port, url, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["45.92.158.150", "154.94.233.166"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.92.158.150", "154.94.233.166"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion", "pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion", "26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion", "ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion", "c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://aheadsupport.co.uk/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a new internal application update using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment package includes custom scripts and binaries that are not yet indexed in the ThreatFox global reputation database, causing the 8 IOCs to trigger as “Unknown.”
  • Filter/Exclusion: Exclude alerts where the source process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, specifically when the file path resides within a known software distribution share (e.g., \\fileserver\Deployments\InternalApps).

• Scheduled Antivirus Definition Updates

  • Scenario: A scheduled task runs nightly to download and install fresh virus definition signatures from a third-party endpoint protection vendor (e.g., CrowdStrike or Symantec). The updater executable downloads temporary files containing new heuristic signatures that appear as unknown IOCs before the local engine fully registers them.
  • Filter/Exclusion: Create an exclusion for processes running under the SYSTEM account with command lines containing keywords like “update,” “signature,” or specific vendor names (e.g., C:\Program Files\CrowdStrike\csagent.exe) during maintenance windows (02:00 – 04:00 UTC).

• Development Environment Build Pipelines

  • Scenario: A CI/CD pipeline (using Jenkins or Azure DevOps) executes a build job on an ephemeral agent. The pipeline compiles source code and generates temporary artifacts, test binaries, and Docker images that have never been seen by the ThreatFox sensor before, triggering the “Unknown malware” logic for all 8