This hunt targets the presence of 22 known indicators of compromise associated with unidentified malware, which may signal an active or dormant infection within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before the unknown malware can establish persistence or execute lateral movement.
Malware Family: Unknown malware Total IOCs: 22 IOC Types: domain, ip:port, sha256_hash, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 34[.]87[.]129[.]214:443 | botnet_cc | 2026-09-22 | 75% |
| ip:port | 36[.]248[.]232[.]160:7443 | botnet_cc | 2026-09-22 | 75% |
| sha256_hash | 0588d510ec0457e8d52bf027abf5364e8af206005241e6eca0ec0b084a7528ae | payload | 2026-09-22 | 75% |
| domain | nuypoiaklber.lol | botnet_cc | 2026-09-22 | 100% |
| ip:port | 102[.]117[.]169[.]159:7443 | botnet_cc | 2026-09-22 | 100% |
| ip:port | 45[.]8[.]46[.]122:8090 | botnet_cc | 2026-09-22 | 100% |
| url | hxxps://smgjamat.in/ | payload_delivery | 2026-09-22 | 90% |
| url | hxxps://heartbeatpipe.net/get_verify | payload_delivery | 2026-09-22 | 80% |
| domain | pixelsoftzone.net | payload_delivery | 2026-09-22 | 80% |
| domain | linkedlin-us.com | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://linkedlin-us.com | payload_delivery | 2026-09-22 | 80% |
| domain | heartbeatpipe.net | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://metricsfeedware.com/js/all.min.js | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://pixelsoftzone.net/first_allow_host | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://heartbeatpipe.net/js/all.min.js | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://metricsfeedware.com/first_allow_host | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://metricsfeedware.com/get_verify | payload_delivery | 2026-09-22 | 80% |
| domain | metricsfeedware.com | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://pixelsoftzone.net/js/all.min.js | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://pixelsoftzone.net/get_verify | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://heartbeatpipe.net/first_allow_host | payload_delivery | 2026-09-22 | 80% |
| url | hxxps://thesnapchatmodapk.com/update2.exe | payload_delivery | 2026-09-22 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["102.117.169.159", "36.248.232.160", "34.87.129.214", "45.8.46.122"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["102.117.169.159", "36.248.232.160", "34.87.129.214", "45.8.46.122"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["nuypoiaklber.lol", "pixelsoftzone.net", "linkedlin-us.com", "heartbeatpipe.net", "metricsfeedware.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://smgjamat.in/", "https://heartbeatpipe.net/get_verify", "https://linkedlin-us.com", "https://metricsfeedware.com/js/all.min.js", "https://pixelsoftzone.net/first_allow_host", "https://heartbeatpipe.net/js/all.min.js", "https://metricsfeedware.com/first_allow_host", "https://metricsfeedware.com/get_verify", "https://pixelsoftzone.net/js/all.min.js", "https://pixelsoftzone.net/get_verify", "https://heartbeatpipe.net/first_allow_host", "https://thesnapchatmodapk.com/update2.exe"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["0588d510ec0457e8d52bf027abf5364e8af206005241e6eca0ec0b084a7528ae"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
node_exporter or a custom health_check script) which binds to a non-standard port or uses a specific hash value that coincidentally matches one of the 22 IOCs.
/usr/local/bin/monitoring/ or the parent process is dockerd/containerd, and verify the binary hash against the internal artifact registry before alerting.7z.exe or winrar.exe) from an internal file share to a temporary directory (%TEMP%) and executes it, triggering an IOC based on file hash or network connection to the internal IP range.
powershell.exe or pwsh.exe, the working directory is %TEMP% or C:\Users\<Admin>\AppData\Local\Temp, and the source IP is within the internal management subnet (e.g., 10.20.0.0/16).helper.exe or svc_agent.dll) and communicates with the backup server over a non-standard port, matching an IOC related to network beaconing or specific file paths.
VeeamSvc.exe, commvault_agent.exe) or the destination port is