This hunt hypothesis targets adversary behavior characterized by the execution of previously unseen malware indicators that may evade standard signature-based defenses. Proactively hunting these specific ThreatFox IOCs within Azure Sentinel is critical to identify early-stage infections and mitigate potential lateral movement before they escalate into significant security incidents.
Malware Family: Unknown malware Total IOCs: 26 IOC Types: domain, ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://markdl.pro/ | payload_delivery | 2026-07-21 | 90% |
| domain | alkociferblat.cc | payload_delivery | 2026-07-21 | 100% |
| ip:port | 124[.]220[.]77[.]21:22 | botnet_cc | 2026-07-21 | 100% |
| ip:port | 47[.]108[.]140[.]10:20885 | botnet_cc | 2026-07-21 | 100% |
| ip:port | 47[.]108[.]140[.]10:20881 | botnet_cc | 2026-07-21 | 100% |
| domain | markdl.pro | payload_delivery | 2026-07-21 | 100% |
| url | hxxp://196[.]251[.]107[.]186/api.php | botnet_cc | 2026-07-21 | 50% |
| ip:port | 101[.]33[.]76[.]127:443 | botnet_cc | 2026-07-21 | 100% |
| ip:port | 31[.]76[.]252[.]47:443 | botnet_cc | 2026-07-21 | 100% |
| url | hxxps://31[.]76[.]252[.]47/v1/telemetry/config | botnet_cc | 2026-07-21 | 50% |
| ip:port | 173[.]225[.]99[.]250:15500 | botnet_cc | 2026-07-21 | 75% |
| domain | monitorondomainwintgt.store | botnet_cc | 2026-07-21 | 100% |
| url | hxxps://www.studiotecnicoareanova.it/ | payload_delivery | 2026-07-21 | 90% |
| domain | testewin.com | botnet_cc | 2026-07-21 | 75% |
| ip:port | 149[.]56[.]12[.]51:443 | botnet_cc | 2026-07-21 | 75% |
| ip:port | 162[.]33[.]178[.]68:80 | botnet_cc | 2026-07-21 | 75% |
| url | hxxp://162[.]33[.]178[.]68/msedge.txt | payload_delivery | 2026-07-21 | 80% |
| ip:port | 206[.]166[.]251[.]123:8591 | botnet_cc | 2026-07-21 | 70% |
| ip:port | 64[.]52[.]80[.]235:80 | payload_delivery | 2026-07-21 | 70% |
| domain | hometwfrbas.com | payload_delivery | 2026-07-21 | 70% |
| url | hxxps://www.fluorite.eu/ | payload_delivery | 2026-07-21 | 90% |
| ip:port | 45[.]61[.]136[.]49:80 | payload_delivery | 2026-07-21 | 80% |
| ip:port | 193[.]149[.]187[.]77:80 | payload_delivery | 2026-07-21 | 75% |
| url | hxxp://193[.]149[.]187[.]77/ | payload_delivery | 2026-07-21 | 75% |
| url | hxxps://theprosperinghouse.com/ | payload_delivery | 2026-07-21 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["193.149.187.77", "173.225.99.250", "206.166.251.123", "162.33.178.68", "101.33.76.127", "64.52.80.235", "45.61.136.49", "31.76.252.47", "149.56.12.51", "124.220.77.21", "47.108.140.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.149.187.77", "173.225.99.250", "206.166.251.123", "162.33.178.68", "101.33.76.127", "64.52.80.235", "45.61.136.49", "31.76.252.47", "149.56.12.51", "124.220.77.21", "47.108.140.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["alkociferblat.cc", "markdl.pro", "monitorondomainwintgt.store", "testewin.com", "hometwfrbas.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://markdl.pro/", "http://196.251.107.186/api.php", "https://31.76.252.47/v1/telemetry/config", "https://www.studiotecnicoareanova.it/", "http://162.33.178.68/msedge.txt", "https://www.fluorite.eu/", "http://193.149.187.77/", "https://theprosperinghouse.com/", "https://theholecompany.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, along with suggested filters or exclusions:
Antivirus Definition Updates via Windows Update
Microsoft Defender Antivirus (or third-party agents like CrowdStrike/SentinelOne) downloading and installing new signature definitions. These updates often introduce new executable hashes and network connections that match the “Unknown” criteria before being fully cataloged in the ThreatFox baseline.Windows Update service (wuauserv) or specific vendor update executables (e.g., MpCmdRun.exe, CSPService.exe). Additionally, whitelist IP ranges associated with major AV vendor update servers (e.g., Microsoft Azure CDN IPs).Software Deployment via SCCM/Intune
System or Network Service accounts specifically when the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe.Scheduled PowerShell Administrative Scripts