ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of ten distinct indicators of compromise (IOCs) linked to previously unidentified malware strains within the network environment. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly identify and isolate emerging threats before they establish persistence or propagate across critical assets.

IOC Summary

Malware Family: Unknown malware Total IOCs: 10 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]145[.]228[.]16:7000`	botnet_cc	2026-08-01	100%
ip:port	`47[.]87[.]84[.]177:7443`	botnet_cc	2026-08-01	75%
ip:port	`43[.]213[.]166[.]7:443`	botnet_cc	2026-08-01	75%
ip:port	`43[.]213[.]254[.]221:80`	botnet_cc	2026-08-01	75%
ip:port	`202[.]182[.]108[.]40:21157`	botnet_cc	2026-08-01	75%
ip:port	`20[.]125[.]96[.]116:443`	botnet_cc	2026-08-01	75%
ip:port	`198[.]46[.]187[.]30:443`	botnet_cc	2026-08-01	75%
ip:port	`117[.]72[.]72[.]254:5005`	botnet_cc	2026-08-01	100%
ip:port	`1[.]117[.]77[.]166:5003`	botnet_cc	2026-08-01	100%
ip:port	`1[.]117[.]77[.]166:443`	botnet_cc	2026-08-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["43.213.166.7", "1.117.77.166", "20.125.96.116", "47.87.84.177", "45.145.228.16", "202.182.108.40", "43.213.254.221", "117.72.72.254", "198.46.187.30"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.213.166.7", "1.117.77.166", "20.125.96.116", "47.87.84.177", "45.145.228.16", "202.182.108.40", "43.213.254.221", "117.72.72.254", "198.46.187.30"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs detection rule:

Scenario: Enterprise Antivirus Definition Updates
- Context: Scheduled daily updates from major security vendors (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often introduce new hash signatures or behavioral indicators that have not yet been ingested into the ThreatFox intelligence feed. The detection logic may flag these fresh definition files as “Unknown” before they are whitelisted in the threat intelligence platform.
- Filter/Exclusion: Exclude IOCs originating from known update servers (e.g., download.microsoft.com, falcon.crowdstrike.com) or filter out hashes associated with specific file paths like C:\ProgramData\Microsoft\Windows Defender\Platform and C:\Program Files\CrowdStrike\Falcon.
Scenario: Automated Patch Management Deployments
- Context: Tools such as SCCM (System Center Configuration Manager) or Ivanti Neurons execute scheduled jobs to deploy patches or new software agents. During the installation phase, these tools generate temporary executable processes and network connections that match generic “unknown” malware profiles due to their transient nature and lack of pre-existing reputation in the ThreatFox database.
- Filter/Exclusion: Create a suppression rule for IOCs generated by specific service accounts (e.g., DOMAIN\SCCM_Service_Account) or exclude process names containing keywords like ccmsetup.exe, IvantiAgent.exe, and wsusutil during standard maintenance windows (e.g., Sunday 02:00–04:00).
Scenario: Internal DevOps CI/CD Pipeline Artifacts
- Context: In environments with active internal development, Jenkins or GitLab runners frequently build and deploy custom Docker containers or microservices. The resulting binaries often possess