This hunt detects adversary behavior characterized by the presence of 39 unknown malware indicators of compromise that may represent novel threats not yet covered by existing signature-based rules. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify and contain emerging malicious activity before it escalates into a widespread incident, ensuring early detection against evolving attack vectors.
Malware Family: Unknown malware Total IOCs: 39 IOC Types: ip:port, domain, url, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | willynop9821.icu | payload_delivery | 2026-08-05 | 100% |
| ip:port | 89[.]208[.]97[.]177:443 | payload_delivery | 2026-08-05 | 100% |
| ip:port | 98[.]159[.]110[.]118:80 | botnet_cc | 2026-08-05 | 75% |
| url | hxxps://98[.]159[.]110[.]118:80/ws | botnet_cc | 2026-08-05 | 100% |
| ip:port | 64[.]227[.]159[.]29:7443 | botnet_cc | 2026-08-05 | 75% |
| ip:port | 57[.]154[.]16[.]246:443 | botnet_cc | 2026-08-05 | 75% |
| ip:port | 207[.]189[.]11[.]170:80 | payload_delivery | 2026-08-05 | 50% |
| ip:port | 207[.]189[.]11[.]170:443 | payload_delivery | 2026-08-05 | 50% |
| domain | blog.derrspecial-onlinedmin.live | botnet_cc | 2026-08-05 | 50% |
| domain | Crestmarkhq.com | payload_delivery | 2026-08-05 | 50% |
| domain | subscription-magnetic-recommended-meat.trycloudflare.com | payload_delivery | 2026-08-05 | 50% |
| ip:port | 45[.]129[.]124[.]182:443 | payload_delivery | 2026-08-05 | 100% |
| ip:port | 36[.]248[.]232[.]165:7443 | botnet_cc | 2026-08-05 | 75% |
| domain | borrylistu898214.icu | payload_delivery | 2026-08-05 | 100% |
| domain | apollonursingresource.com | payload_delivery | 2026-08-05 | 75% |
| ip:port | 149[.]28[.]163[.]119:7443 | botnet_cc | 2026-08-05 | 75% |
| ip:port | 207[.]174[.]0[.]143:8080 | botnet_cc | 2026-08-05 | 50% |
| ip:port | 207[.]174[.]0[.]143:841 | botnet_cc | 2026-08-05 | 50% |
| ip:port | 142[.]202[.]191[.]225:80 | botnet_cc | 2026-08-05 | 50% |
| ip:port | 142[.]202[.]191[.]225:8041 | botnet_cc | 2026-08-05 | 50% |
| domain | route.techquarter.xyz | botnet_cc | 2026-08-05 | 100% |
| url | hxxps://route.techquarter.xyz/pipe | botnet_cc | 2026-08-05 | 100% |
| url | hxxps://build.netbazaar.lol/collect | botnet_cc | 2026-08-05 | 100% |
| domain | netbazaar.lol | botnet_cc | 2026-08-05 | 100% |
| domain | build.netbazaar.lol | botnet_cc | 2026-08-05 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["207.174.0.143", "107.173.241.193", "45.129.124.182", "142.202.191.225", "46.226.162.241", "57.154.16.246", "165.22.69.214", "89.208.97.177", "207.189.11.170", "36.248.232.165", "89.208.97.111", "64.227.159.29", "98.159.110.118", "149.28.163.119"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["207.174.0.143", "107.173.241.193", "45.129.124.182", "142.202.191.225", "46.226.162.241", "57.154.16.246", "165.22.69.214", "89.208.97.177", "207.189.11.170", "36.248.232.165", "89.208.97.111", "64.227.159.29", "98.159.110.118", "149.28.163.119"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["willynop9821.icu", "blog.derrspecial-onlinedmin.live", "Crestmarkhq.com", "subscription-magnetic-recommended-meat.trycloudflare.com", "borrylistu898214.icu", "apollonursingresource.com", "route.techquarter.xyz", "netbazaar.lol", "build.netbazaar.lol", "vaillyharry9988.icu", "roadsteriio981.icu", "dollllar881122.icu", "chocolate412932.icu", "stfrancisvilla.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://98.159.110.118:80/ws", "https://route.techquarter.xyz/pipe", "https://build.netbazaar.lol/collect", "http://46.226.162.241/411f7d3bff31a?force=1", "http://46.226.162.241/d90acb823cb7c7?force=1", "http://46.226.162.241/211f79a06c?force=1"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["04b8d6f7158689a311b22200c4c0fb5186a6751a422b5510b5a5fbf1c2a9cd5f", "4c48cbbd55ff2b63a1fca862b8bb8ff00eec90050b2a2608140bbb3b2ad03f54"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs rule in an enterprise environment:
Scenario: Automated Patch Management Scans
ccmexec.exe, IvantiAgent.exe) and User Context (exclude accounts ending in _svc or specific patching service accounts). Alternatively, filter out IOCs where the file age is less than 48 hours.Scenario: Internal CI/CD Pipeline Artifacts
.jar, .dll, .exe located in specific deployment directories like C:\Builds\Staging).Scenario: Scheduled Backup and Archiving Jobs