ThreatFox: Unknown malware IOCs

Hunt Hypothesis

The ThreatFox: Unknown malware IOCs rule detects potential adversary activity involving unknown malicious indicators that may be associated with advanced persistent threats. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate emerging threats before they cause significant damage.

IOC Summary

Malware Family: Unknown malware Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["cdnportal-us.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://aidancollege.ac.ug/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

• Scenario: A system administrator is using PowerShell to run a scheduled job that downloads a legitimate software update from a known internal repository.
  Filter/Exclusion: Exclude any IOCs that match internal IP ranges or domains used by the company’s software update servers.

• Scenario: A security analyst is performing a Windows Event Log analysis using PowerShell to extract logs from the Event Viewer, which includes IOCs related to system events.
  Filter/Exclusion: Exclude any IOCs that are associated with the EventLog module or system event IDs (e.g., 1, 41, 4624).

• Scenario: A DevOps team is deploying a CI/CD pipeline using Jenkins and is executing a script that interacts with a remote artifact repository, which may include benign IOCs.
  Filter/Exclusion: Exclude IOCs that match known CI/CD tools or repositories (e.g., jenkins.io, artifactory.example.com).

• Scenario: A database administrator is using SQL Server Management Studio (SSMS) to run a query that connects to a remote database, which may include IP addresses or hostnames that are flagged as IOCs.
  Filter/Exclusion: Exclude IOCs that are associated with internal database servers or known SQL Server instances (e.g., db-server-01.example.com).

• Scenario: A system is running a scheduled backup job using Veeam that temporarily connects to a remote backup server, which may include network IOCs that are flagged by the rule.
  Filter/Exclusion: Exclude IOCs that are associated with Veeam backup servers or internal backup infrastructure (e.g., backup-server.example.com).