The ThreatFox: Unknown malware IOCs rule detects potential adversary activity involving previously unidentified malicious indicators, suggesting the presence of unknown malware in the environment. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate advanced threats that evade traditional detection methods.
IOC Summary
Malware Family: Unknown malware Total IOCs: 20 IOC Types: url, ip:port, sha256_hash, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | thisismine.asia | payload_delivery | 2026-06-11 | 100% |
| ip:port | 209[.]99[.]184[.]216:56001 | botnet_cc | 2026-06-11 | 75% |
| ip:port | 209[.]99[.]184[.]216:56002 | botnet_cc | 2026-06-11 | 75% |
| ip:port | 209[.]99[.]184[.]216:56003 | botnet_cc | 2026-06-11 | 75% |
| url | hxxp://154[.]198[.]50[.]76:8080/upload | botnet_cc | 2026-06-11 | 100% |
| ip:port | 209[.]99[.]191[.]186:8765 | botnet_cc | 2026-06-11 | 75% |
| sha256_hash | 7c69d70092676725b6e9269e08f842b22a21eff319240a31b2dfc44147d05d05 | payload | 2026-06-11 | 75% |
| url | hxxp://5[.]83[.]134[.]26/ssh | payload_delivery | 2026-06-11 | 75% |
| url | hxxps://bw-development.app/Antibot2 | payload_delivery | 2026-06-11 | 75% |
| url | hxxps://github.com/hothehottest/Recaptcha-2/releases/download/Recaptcha-2/boost.zip | payload_delivery | 2026-06-11 | 75% |
| sha256_hash | 13059a7cf8cc3820f5d36262c5f5d375465297a6fff8fcefc5fd8d520030ff96 | payload | 2026-06-11 | 75% |
| sha256_hash | 8eac8373cb9b6a8004942871ebc691d900a8116c9dede5e3a222392227033245 | payload | 2026-06-11 | 75% |
| sha256_hash | 07353da1a94a7dc214947fc35f134452b4dba8a6ae81464328d9cf0d1cedc6ba | payload | 2026-06-11 | 75% |
| sha256_hash | bbc8da2cceb3a174e2b0df87bc43c54d3cf3edadb585658bb65517c8f88249b8 | payload | 2026-06-11 | 75% |
| domain | ghukonhgf.com | botnet_cc | 2026-06-11 | 75% |
| url | hxxps://ghukonhgf.com/api/ | botnet_cc | 2026-06-11 | 75% |
| domain | getbrowseronline.com | payload_delivery | 2026-06-10 | 100% |
| domain | autoupdateing.com | payload_delivery | 2026-06-10 | 100% |
| domain | fastonlineupdate.com | payload_delivery | 2026-06-10 | 100% |
| domain | getupdatefast.com | payload_delivery | 2026-06-10 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["209.99.184.216", "209.99.191.186"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["209.99.184.216", "209.99.191.186"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["thisismine.asia", "ghukonhgf.com", "getbrowseronline.com", "autoupdateing.com", "fastonlineupdate.com", "getupdatefast.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["http://154.198.50.76:8080/upload", "http://5.83.134.26/ssh", "https://bw-development.app/Antibot2", "https://github.com/hothehottest/Recaptcha-2/releases/download/Recaptcha-2/boost.zip", "https://ghukonhgf.com/api/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["7c69d70092676725b6e9269e08f842b22a21eff319240a31b2dfc44147d05d05", "13059a7cf8cc3820f5d36262c5f5d375465297a6fff8fcefc5fd8d520030ff96", "8eac8373cb9b6a8004942871ebc691d900a8116c9dede5e3a222392227033245", "07353da1a94a7dc214947fc35f134452b4dba8a6ae81464328d9cf0d1cedc6ba", "bbc8da2cceb3a174e2b0df87bc43c54d3cf3edadb585658bb65517c8f88249b8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A system administrator is using PowerShell to run a scheduled job that downloads a legitimate update from a known internal repository.
Filter/Exclusion: Exclude IOCs related to internal IP ranges or internal domain names used for software updates.
Scenario: A DevOps engineer is using Ansible to deploy a new application, which involves copying files from a shared network drive (e.g., \\fileserver\shared\app-release).
Filter/Exclusion: Exclude network paths that match internal file server shares or known deployment directories.
Scenario: A database administrator is using SQL Server Agent to run a nightly backup job that connects to a remote backup server (e.g., backup-server.example.com).
Filter/Exclusion: Exclude connections to known internal backup servers or domains used for database maintenance.
Scenario: A security analyst is using Wireshark to capture and analyze network traffic for a forensic investigation, which includes exporting packets to a local file (/var/log/traffic.pcap).
Filter/Exclusion: Exclude file paths or processes associated with network analysis tools or forensic artifacts.
Scenario: A system administrator is using Windows Task Scheduler to run a script that queries the Windows Event Log for audit purposes, which involves accessing the event log file (C:\Windows\System32\winevt\Logs\SecEvent.Evt).
Filter/Exclusion: Exclude file paths or processes related to system logging or event monitoring tools.