ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of twenty distinct indicators of compromise linked to previously unidentified malware families within the Azure Sentinel environment. Proactively hunting for these unknown threats is critical because it enables the SOC team to identify and contain novel attack vectors before they escalate into widespread incidents, thereby reducing dwell time for emerging risks that standard signature-based rules may miss.

IOC Summary

Malware Family: Unknown malware Total IOCs: 20 IOC Types: sha256_hash, ip:port, url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxps://www.einvoicesolutions.com/`	payload_delivery	2026-06-30	90%
url	`hxxps://www.m-und-c-partners.de/`	payload_delivery	2026-06-30	90%
ip:port	`170[.]64[.]130[.]99:7443`	botnet_cc	2026-06-30	75%
ip:port	`136[.]113[.]49[.]8:7443`	botnet_cc	2026-06-30	75%
url	`hxxp://31[.]56[.]48[.]179:666/w`	payload_delivery	2026-06-30	75%
url	`hxxp://31[.]56[.]48[.]179:666/.real_mnd`	payload_delivery	2026-06-30	75%
url	`hxxp://31[.]56[.]48[.]179:666/.mconf`	payload_delivery	2026-06-30	75%
sha256_hash	`27cc6cf232ba7ed8dc92dcb0795bdb7185197928ec3061a8d6de097f9efc5440`	payload	2026-06-30	75%
sha256_hash	`0f63bea320d768fb12bb53a287f210b8b9ccec563ac66dc80b7967628e455566`	payload	2026-06-30	75%
url	`hxxps://isabeladandaro.com.br/diagnostico-de-honorarios-convite/?src=Org_Site&utm_source=Org&utm_medium=Site&utm_content=&utm_campaign=&utm_term=`	payload_delivery	2026-06-30	90%
url	`hxxps://www.ibogainerapiddetox.com/`	payload_delivery	2026-06-30	90%
url	`hxxps://ottixpimobiliaria.com/`	payload_delivery	2026-06-30	90%
url	`hxxps://patrickfarrellbooks.com/`	payload_delivery	2026-06-30	90%
url	`hxxps://portalpsicosocial.es/`	payload_delivery	2026-06-30	90%
url	`hxxps://romayahomes.co.uk/`	payload_delivery	2026-06-30	90%
url	`hxxps://seniorcitizenjournal.com/`	payload_delivery	2026-06-30	90%
url	`hxxps://leinstermetalrecycling.ie/`	payload_delivery	2026-06-30	90%
url	`hxxps://itsrealmedia.com/`	payload_delivery	2026-06-30	90%
ip:port	`110[.]42[.]252[.]147:8888`	botnet_cc	2026-06-30	100%
ip:port	`155[.]138[.]218[.]137:7443`	botnet_cc	2026-06-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["136.113.49.8", "170.64.130.99", "110.42.252.147", "155.138.218.137"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["136.113.49.8", "170.64.130.99", "110.42.252.147", "155.138.218.137"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://www.einvoicesolutions.com/", "https://www.m-und-c-partners.de/", "http://31.56.48.179:666/w", "http://31.56.48.179:666/.real_mnd", "http://31.56.48.179:666/.mconf", "https://isabeladandaro.com.br/diagnostico-de-honorarios-convite/?src=Org_Site&utm_source=Org&utm_medium=Site&utm_content=&utm_campaign=&utm_term=", "https://www.ibogainerapiddetox.com/", "https://ottixpimobiliaria.com/", "https://patrickfarrellbooks.com/", "https://portalpsicosocial.es/", "https://romayahomes.co.uk/", "https://seniorcitizenjournal.com/", "https://leinstermetalrecycling.ie/", "https://itsrealmedia.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["27cc6cf232ba7ed8dc92dcb0795bdb7185197928ec3061a8d6de097f9efc5440", "0f63bea320d768fb12bb53a287f210b8b9ccec563ac66dc80b7967628e455566"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs rule, including suggested filters or exclusions tailored for an enterprise environment:

Endpoint Protection Scanning and Quarantine Operations
- Scenario: Enterprise Endpoint Detection and Response (EDR) tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently generate new IOCs when they scan, quarantine, or update their definition databases. These tools may create temporary file hashes or network connections to their cloud management consoles that match the “Unknown malware” signature logic before being fully whitelisted in ThreatFox.
- Suggested Filter: Exclude traffic originating from known EDR sensor subnets (e.g., 10.20.30.0/24) or filter out IOCs where the source process name matches standard EDR agents (e.g., csagent.exe, SentinelOneAgent.exe, MsMpEng.exe).
Software Deployment and Patch Management Jobs
- Scenario: Scheduled deployment tasks using tools like Microsoft SCCM, Ivanti Endpoint Manager, or Ansible Tower often distribute new application binaries, script files, or patch installers to workstations. These newly deployed executables may not yet be present in the ThreatFox threat intelligence feed, triggering alerts for “Unknown” IOCs during the initial rollout phase (e.g., a Tuesday morning Windows Update cycle).
- Suggested Filter: Create an exclusion rule for IOCs associated with known deployment service accounts (e.g., svc-scmm-deploy, ansible-admin) or exclude file hashes that match the internal artifact repository signature (e.g., files hosted on internal-artifacts.corp.local).
Third-Party Cloud SaaS Connectivity
- Scenario: Legitimate business applications such as **Sales