ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors utilize the Unknown Loader to execute initial payload delivery and establish persistence through five specific indicators of compromise. Proactive hunting in Azure Sentinel is critical because these IOCs often represent early-stage infection vectors that may evade standard signature-based defenses, allowing attackers to maintain a low profile before lateral movement begins.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 5 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["woolstem.xyz", "dddododiiik.com", "extranet-partners-report.com", "imagesafedown.info", "mentopo.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Enterprise Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune service executes a background update task that downloads and unpacks a new application installer. This process often generates temporary executable files in the C:\Windows\CCMCache directory with hash values matching “Unknown Loader” IOCs before they are fully registered in the internal threat intelligence feed.
  • Filter/Exclusion: Exclude file paths containing \Microsoft Intune Management Extension\, \CCMCache\, and process names ccmexec.exe or IntuneManagementExtension.exe. Additionally, whitelist hash values associated with known vendor signatures (e.g., Microsoft, Adobe) that are frequently flagged as “unknown” due to rapid patching cycles.

• Automated Database Maintenance and Backup Jobs

  • Scenario: Scheduled SQL Server maintenance jobs or third-party backup agents (such as Veeam Agent or Commvault) trigger a loader script to initialize the backup engine. These scripts often spawn child processes that load dynamic libraries from network shares, triggering IOCs related to “Unknown Loader” activity during the early morning maintenance window (e.g., 02:00 – 04:00).
  • Filter/Exclusion: Create a time-based filter to suppress alerts between 01:00 and 05:00 UTC for processes originating from the C:\Program Files\Microsoft SQL Server\MSSQL* directory. Explicitly exclude parent process names like sqlservr.exe, vbruntime.exe, or simagent.exe.

• IT Admin Scripting with PowerShell and Python

  • **Scenario