ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of eleven distinct indicators of compromise (IOCs) linked to previously unidentified malware strains within the Azure Sentinel environment. Proactive hunting is essential because these unknown threats often evade signature-based detection, requiring manual correlation and rapid response to prevent potential lateral movement or data exfiltration before automated rules can be refined.

IOC Summary

Malware Family: Unknown malware Total IOCs: 11 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["60.205.115.92", "203.195.217.161", "189.141.45.95", "111.170.148.134"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["60.205.115.92", "203.195.217.161", "189.141.45.95", "111.170.148.134"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://pol.1000boger.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown malware

False Positive Guidance

False Positive Scenarios for “ThreatFox: Unknown malware IOCs” Rule

• Scenario: Enterprise Antivirus Signature Updates

  • Context: The endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled daily update of its definition database. This process often generates new hash values and file paths that have not yet been ingested into the ThreatFox intelligence platform, triggering an “Unknown” status.
  • Suggested Filter/Exclusion: Exclude IOCs where the source hostname matches known AV management servers (e.g., AV-UPDATE-SRV01) or where the file extension is specific to signature updates (.cab, .dat). Additionally, filter out events occurring within a 30-minute window after the scheduled update job runs.

• Scenario: Development Environment Deployment Pipelines

  • Context: CI/CD pipelines (e.g., Jenkins or Azure DevOps) on build agents frequently compile and stage new application binaries before they are promoted to production. These newly built artifacts possess unique hashes that do not exist in the ThreatFox global threat library yet, causing false alerts during nightly builds.
  • Suggested Filter/Exclusion: Create an exclusion rule for IOCs originating from specific build agent subnets (e.g., 10.20.45.0/24) or where the process name contains known pipeline identifiers like jenkins-agent or azure-build-runner.

• Scenario: Third-Party Software Patching Cycles

  • Context: IT administrators use tools like SCCM (System Center Configuration Manager) or Ivanti to push patches for critical third-party applications (e.g., Adobe Acrobat, Zoom, Chrome). The patch installer often extracts temporary files with new hashes that are flagged as unknown until the vendor updates their public IOCs.
  • **Suggested Filter