This hunt detects adversary behavior characterized by the presence of twenty-nine distinct indicators of compromise (IOCs) linked to previously unidentified malware strains that may evade standard signature-based defenses. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain emerging threats before they establish persistence or propagate lateral movement across the enterprise network.
Malware Family: Unknown malware Total IOCs: 29 IOC Types: url, domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | testmyopinion.live | payload_delivery | 2026-08-10 | 75% |
| ip:port | 52[.]203[.]242[.]163:7835 | botnet_cc | 2026-08-10 | 75% |
| ip:port | 52[.]203[.]242[.]163:7890 | botnet_cc | 2026-08-10 | 75% |
| url | hxxps://versionpi81.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://riderls32.life/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://rogethat231.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| domain | fashion-chicken.com | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://id-verif-code.info/api.php | payload_delivery | 2026-08-10 | 100% |
| ip:port | 158[.]94[.]211[.]92:80 | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://dolpi812.life/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://accrenpi813.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://thankingpi.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://bunntyca.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://wikkkipi12.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://tokerjoker.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://atomento10.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://frontalback91.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://corrykro.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://rumbaju42.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://nick-metry.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| url | hxxps://borrowskol312.icu/t.js | payload_delivery | 2026-08-10 | 100% |
| ip:port | 102[.]117[.]174[.]217:7443 | botnet_cc | 2026-08-10 | 100% |
| domain | veralok.click | payload_delivery | 2026-08-10 | 75% |
| domain | riderls32.life | payload_delivery | 2026-08-10 | 100% |
| domain | dolpi812.life | payload_delivery | 2026-08-10 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["52.203.242.163", "102.117.174.217", "158.94.211.92"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["52.203.242.163", "102.117.174.217", "158.94.211.92"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["testmyopinion.live", "fashion-chicken.com", "veralok.click", "riderls32.life", "dolpi812.life", "japansnowaccommodation.com", "blackjacktrailerjacks.com.au", "expressbatteryreplacement.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://versionpi81.icu/t.js", "https://riderls32.life/t.js", "https://rogethat231.icu/t.js", "https://id-verif-code.info/api.php", "https://dolpi812.life/t.js", "https://accrenpi813.icu/t.js", "https://thankingpi.icu/t.js", "https://bunntyca.icu/t.js", "https://wikkkipi12.icu/t.js", "https://tokerjoker.icu/t.js", "https://atomento10.icu/t.js", "https://frontalback91.icu/t.js", "https://corrykro.icu/t.js", "https://rumbaju42.icu/t.js", "https://nick-metry.icu/t.js", "https://borrowskol312.icu/t.js", "https://fashion-chicken.com/x9i32md/w1/la02"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs detection rule:
Scenario: Legitimate deployment of new software patches via enterprise management suites (e.g., Microsoft Endpoint Configuration Manager or Ivanti) where the installer executable hashes have not yet been ingested into the ThreatFox reputation database.
DOMAIN\svc-SCCM, DOMAIN\patch-admin) and exclude hash ranges associated with trusted vendor installers (e.g., .msi files from Microsoft Corporation or Ivanti, Inc.) within the last 48 hours of their first appearance.Scenario: Scheduled backup jobs utilizing third-party agents (e.g., Veeam Backup & Replication or Commvault) that generate temporary log files and snapshot executables with high entropy, mimicking packed malware behavior.
DOMAIN\VeeamService) during defined maintenance windows (e.g., 02:00–04:00 daily) and filter out IOCs where the file path contains standard backup directories like \Veeam\Backup or \Commvault\Agent.Scenario: Automated security scanning tools (e.g., CrowdStrike Falcon, Symantec Endpoint Protection) performing on-demand scans that spawn temporary child processes with unique hashes not yet whitelisted in the global IOC feed.
C:\Program Files\CrowdStrike\FalconSensor\csagent.exe) and the child process name matches common scanner patterns like falcon-scan or `symantec-rtvscan