ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing the Unknown Loader mechanism to execute malicious payloads through specific indicators of compromise (IOCs) designed to evade standard signature-based defenses. Proactive hunting for these IOCs within Azure Sentinel is critical to identify early-stage lateral movement and data exfiltration attempts before they escalate into full-blown incidents.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["validateinfo.cloud", "imagehubguest.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, tailored for a legitimate enterprise environment:

• Automated Software Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) performs scheduled application updates or patches. During this process, the ccmexec.exe service downloads and extracts installer packages containing generic loader scripts (e.g., setup_loader.dll or install_helper.exe) that match the “Unknown Loader” IOCs but are signed by the organization’s internal CA.
  • Suggested Filter: Exclude network connections and file creations where the parent process is ccmexec.exe AND the file hash matches a known whitelist of approved deployment artifacts, OR exclude traffic originating from the specific SCCM Management Point IP range.

• Enterprise Antivirus Real-Time Scanning

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) triggers a real-time scan on user downloads. The AV engine utilizes its own internal loader modules to unpack compressed archives (.zip, .cab) before scanning the contents, generating IOCs that mimic an external “Unknown Loader” behavior but are part of standard hygiene operations.
  • Suggested Filter: Create an exclusion for processes with the executable path containing \Program Files\Microsoft Defender\ or \CrowdStrike\, specifically filtering out events where the process name includes keywords like MsMpEng.exe or csagent.exe.

• Scheduled PowerShell Maintenance Scripts

  • Scenario: A nightly scheduled task runs a custom PowerShell script (e.g., Daily_System_Hygiene.ps1) to clean temporary files and update local configurations. This script invokes the .NET runtime loader (wsmprovhost.exe or powershell.exe) which dynamically loads assembly dependencies that match the “Unknown Loader