This detection rule identifies potential unknown malware infections by correlating network and endpoint telemetry against a curated set of 55 Indicators of Compromise (IOCs) from ThreatFox. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover stealthy, zero-day threats that evade signature-based defenses, allowing the SOC team to initiate rapid containment before adversaries establish persistence or exfiltrate sensitive data.
Malware Family: Unknown malware Total IOCs: 55 IOC Types: url, domain, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | abcsgftr.cc | payload_delivery | 2026-07-23 | 100% |
| domain | authorization-id-browser.info | payload_delivery | 2026-07-23 | 100% |
| domain | krabochel.pro | payload_delivery | 2026-07-23 | 100% |
| ip:port | 178[.]156[.]186[.]93:7443 | botnet_cc | 2026-07-23 | 75% |
| ip:port | 47[.]108[.]140[.]10:20888 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 47[.]108[.]140[.]10:8097 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 47[.]108[.]140[.]10:20883 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 47[.]108[.]140[.]10:3182 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 154[.]8[.]155[.]23:22 | botnet_cc | 2026-07-23 | 100% |
| url | hxxps://www.picollege.com/ | payload_delivery | 2026-07-23 | 90% |
| ip:port | 64[.]177[.]113[.]11:7443 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 194[.]110[.]173[.]68:7443 | botnet_cc | 2026-07-23 | 100% |
| ip:port | 174[.]138[.]9[.]149:7443 | botnet_cc | 2026-07-23 | 100% |
| url | hxxps://www.capitolosfera.it/ | payload_delivery | 2026-07-23 | 90% |
| url | hxxps://calacosta.com/ | payload_delivery | 2026-07-23 | 90% |
| url | hxxps://krabochel.pro/ | payload_delivery | 2026-07-23 | 90% |
| url | hxxps://martamartinezvet.com/ | payload_delivery | 2026-07-23 | 90% |
| domain | bryk.telegrarn.fun | payload_delivery | 2026-07-23 | 100% |
| domain | axes.endl.site | payload_delivery | 2026-07-23 | 100% |
| url | hxxps://axes.endl.site/adv2.php | botnet_cc | 2026-07-23 | 100% |
| domain | sni13.docsmanagement.endl.site | payload_delivery | 2026-07-23 | 100% |
| url | hxxps://global-research.space/adv13.php | payload_delivery | 2026-07-23 | 100% |
| domain | global-research.space | payload_delivery | 2026-07-23 | 100% |
| url | hxxps://www.recapcha.space/ | payload_delivery | 2026-07-23 | 90% |
| url | hxxps://www.recapcha.store/ | payload_delivery | 2026-07-23 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["64.177.113.11", "174.138.9.149", "154.8.155.23", "178.156.186.93", "194.110.173.68", "47.108.140.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.177.113.11", "174.138.9.149", "154.8.155.23", "178.156.186.93", "194.110.173.68", "47.108.140.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["abcsgftr.cc", "authorization-id-browser.info", "krabochel.pro", "bryk.telegrarn.fun", "axes.endl.site", "sni13.docsmanagement.endl.site", "global-research.space"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://www.picollege.com/", "https://www.capitolosfera.it/", "https://calacosta.com/", "https://krabochel.pro/", "https://martamartinezvet.com/", "https://axes.endl.site/adv2.php", "https://global-research.space/adv13.php", "https://www.recapcha.space/", "https://www.recapcha.store/", "https://djmaurinho.com.br/", "https://www.duquai.com/", "https://designsbymeinc.com/", "https://finishedimage.co.za/", "https://bringlearngrow.com/", "https://dailycode.dev/", "https://clubcanin-loctudy.fr/", "https://cursohenfil.com.br/", "https://denvercasado.com/", "https://design77.org/", "https://ashtagmarketing.co.za/", "https://adj-tech.mx/", "https://angular-engenharia.com.br/", "https://marianabertelli.com/", "https://mateuszchwalisz.pl/", "https://kfcom.com.br/", "https://leprintexpress.com/", "https://kwiaciarniaem.pl/", "https://jie-lin.com/", "https://massagelichaamswerk.nl/", "https://imperadoruniformes.com.br/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:
Scenario: Corporate Endpoint Protection Scans
MSSQL$FALCON or SYSTEM) and restrict detection to files located in temporary scan directories like C:\ProgramData\McAfee\Agent\Quarantine or C:\Windows\System32\GroupPolicy.Scenario: Automated Software Deployment via SCCM/Intune
10.20.5.0/24 for SCCM servers) and exclude IOCs where the process parent name matches known deployment agents such as ccmsetup.exe, msiexec.exe, or IntuneAgent.exe.Scenario: Internal DevOps CI/CD Pipeline Artifacts