The ThreatFox: Unknown malware IOCs rule detects potential adversary activity involving previously unseen malicious indicators, which may indicate the presence of novel or zero-day threats. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate unknown malware before it causes significant damage.
IOC Summary
Malware Family: Unknown malware Total IOCs: 39 IOC Types: ip:port, domain, url, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 35[.]77[.]84[.]233:8888 | botnet_cc | 2026-05-31 | 100% |
| ip:port | 152[.]53[.]195[.]231:22 | payload_delivery | 2026-05-31 | 80% |
| url | hxxp://34[.]11[.]136[.]102/meow | payload_delivery | 2026-05-31 | 75% |
| url | hxxp://34[.]11[.]136[.]102/meowarm64 | payload_delivery | 2026-05-31 | 75% |
| url | hxxp://35[.]231[.]74[.]47/meow | payload_delivery | 2026-05-31 | 75% |
| url | hxxps://www.abdgochizmetleri.com/ | payload_delivery | 2026-05-31 | 90% |
| ip:port | 172[.]81[.]178[.]237:443 | botnet_cc | 2026-05-31 | 100% |
| ip:port | 69[.]197[.]178[.]164:8089 | botnet_cc | 2026-05-31 | 100% |
| domain | ppsecure-webssappenableconfirmation.horizontaltango.net | payload_delivery | 2026-05-31 | 75% |
| domain | chase-cvs.org.uk | payload_delivery | 2026-05-31 | 75% |
| domain | www.usaa-login-verify-usaa.chase-cvs.org.uk | payload_delivery | 2026-05-31 | 75% |
| url | hxxps://auth-captcha.click/ | payload_delivery | 2026-05-31 | 75% |
| domain | auth-captcha.click | payload_delivery | 2026-05-31 | 75% |
| url | hxxps://connectdplus.com/captcha.php | payload_delivery | 2026-05-30 | 90% |
| url | hxxps://pusanik.shop/ | payload_delivery | 2026-05-30 | 90% |
| domain | 3xcv09.lusy.ink | payload_delivery | 2026-05-30 | 90% |
| domain | rorl.lusy.ink | payload_delivery | 2026-05-30 | 90% |
| url | hxxps://bearman.bond/ | payload_delivery | 2026-05-30 | 90% |
| domain | q24e0.lusy.ink.orgid.com | payload_delivery | 2026-05-30 | 90% |
| domain | yp7s.lusy.ink | payload_delivery | 2026-05-30 | 90% |
| domain | yxc1.lusy.ink | payload_delivery | 2026-05-30 | 90% |
| domain | secure-web.cisco.com.whm.linkedin.com.agriturismoaipiacentini.site | payload_delivery | 2026-05-30 | 90% |
| url | hxxps://yp7s.lusy.ink/ppsecure/post.srf | payload_delivery | 2026-05-30 | 90% |
| url | hxxps://yxc1.lusy.ink/settings-validation | payload_delivery | 2026-05-30 | 90% |
| url | hxxps://secure-web.cisco.com.whm.linkedin.com.agriturismoaipiacentini.site/ | payload_delivery | 2026-05-30 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["172.81.178.237", "152.53.195.231", "35.77.84.233", "69.197.178.164", "13.215.203.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.81.178.237", "152.53.195.231", "35.77.84.233", "69.197.178.164", "13.215.203.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["ppsecure-webssappenableconfirmation.horizontaltango.net", "chase-cvs.org.uk", "www.usaa-login-verify-usaa.chase-cvs.org.uk", "auth-captcha.click", "3xcv09.lusy.ink", "rorl.lusy.ink", "q24e0.lusy.ink.orgid.com", "yp7s.lusy.ink", "yxc1.lusy.ink", "secure-web.cisco.com.whm.linkedin.com.agriturismoaipiacentini.site", "bearman.bond", "roblox-execu.com", "roblox-execut.net", "nightmare-cheats.cc", "nexus-mods.cc", "bytearmor.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://34.11.136.102/meow", "http://34.11.136.102/meowarm64", "http://35.231.74.47/meow", "https://www.abdgochizmetleri.com/", "https://auth-captcha.click/", "https://connectdplus.com/captcha.php", "https://pusanik.shop/", "https://bearman.bond/", "https://yp7s.lusy.ink/ppsecure/post.srf", "https://yxc1.lusy.ink/settings-validation", "https://secure-web.cisco.com.whm.linkedin.com.agriturismoaipiacentini.site/", "https://api.h1gh-l3v-aso-xyxi.xyz/api/upload/screenshot", "https://api.h1gh-l3v-aso-xyxi.xyz/api/upload/files", "https://api.h1gh-l3v-aso-xyxi.xyz/api/upload/zip", "https://api.h1gh-l3v-aso-xyxi.xyz/api/downloads/filegrab-config", "https://api.h1gh-l3v-aso-xyxi.xyz/api/upload/keys", "https://api.h1gh-l3v-aso-xyxi.xyz/api/upload/specs"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["262ce2aa04ea6d8e311edef8128ffd2ddcae4c231f01a8d09f8aeb0a7ea09fcf"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: System update or patching process using wsusoffline or Windows Update
Filter/Exclusion: Check for ProcessName containing wuauclt.exe or wsusoffline and filter out events related to Windows Update or WSUS tasks.
Scenario: Scheduled backup job using Veeam Backup & Replication or Commvault
Filter/Exclusion: Filter events where ProcessName is veeambackup.exe or cvbackup.exe and exclude any IOCs associated with backup-related directories or files.
Scenario: Admin task using PowerShell to manage system services or configurations
Filter/Exclusion: Exclude events where ProcessName is powershell.exe and the command line includes administrative tasks like Stop-Service, Set-Service, or Get-Service.
Scenario: Log management tool like Splunk or ELK Stack performing data ingestion
Filter/Exclusion: Filter out events where ProcessName is splunkd.exe, logstash, or kibana and exclude any IOCs related to log collection or indexing activities.
Scenario: Antivirus or endpoint protection software like Kaspersky, Bitdefender, or Malwarebytes performing a scan
Filter/Exclusion: Exclude events where ProcessName is kavservice.exe, bdagent.exe, or mbam.exe and filter out any IOCs associated with malware scanning or quarantine operations.