This rule detects potential data exfiltration and command-and-control activity by identifying network connections to known malicious IOCs associated with phishing-delivered malware. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised assets and disrupt adversary persistence before lateral movement or significant data loss occurs.
Malware Family: Unknown malware Total IOCs: 20 IOC Types: ip:port, domain, url, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]36[.]40[.]185:7443 | botnet_cc | 2026-09-20 | 75% |
| ip:port | 167[.]235[.]0[.]162:443 | botnet_cc | 2026-09-20 | 75% |
| url | hxxps://167[.]235[.]0[.]162/api/forensics | botnet_cc | 2026-09-20 | 100% |
| ip:port | 36[.]248[.]232[.]184:7443 | botnet_cc | 2026-09-20 | 75% |
| url | hxxps://the.earth.li/~sgtatham/putty/0[.]85/w64/putty.exe | payload_delivery | 2026-09-20 | 90% |
| sha256_hash | 28e0c4d5bc6675537ba47c6529877a3194a29585fb86477f66bf13c79252d2f0 | payload | 2026-09-20 | 100% |
| sha256_hash | 7d55a90710b8e79283efd756e8d3423fc23e0dcf742d6027b1a2a1b9d02a9c16 | payload | 2026-09-20 | 100% |
| sha256_hash | 79a47c33335fe1ed871a23cf7972652ee08a3ec0afed1c2dc6b5a8df675e153d | payload | 2026-09-20 | 100% |
| sha256_hash | ffe04bc05a56f78b1273876cf17ded8df1aa3da5a15deb17dce99a3e206eb705 | payload | 2026-09-20 | 100% |
| sha256_hash | a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125 | payload | 2026-09-20 | 100% |
| sha256_hash | c1c122869f46aaf8c4e90f3132c93a801c853244c756966952d0bf19241cf084 | payload | 2026-09-20 | 100% |
| sha256_hash | 2bcc91fdedb8c583a9fe883be9ad453333a1bba0fdf655474982db3cbb8e7a74 | payload | 2026-09-20 | 100% |
| ip:port | 169[.]58[.]248[.]162:443 | botnet_cc | 2026-09-20 | 100% |
| domain | digital.digitaldatainsights.org | payload_delivery | 2026-09-20 | 75% |
| url | hxxp://195[.]24[.]237[.]240/.x/black3 | payload_delivery | 2026-09-20 | 75% |
| url | hxxp://178[.]16[.]55[.]93/Bin/ScreenConnect.ClientSetup.exe | payload_delivery | 2026-09-20 | 85% |
| ip:port | 103[.]170[.]217[.]184:8787 | botnet_cc | 2026-09-20 | 50% |
| url | hxxps://squidscript.com/ | payload_delivery | 2026-09-20 | 90% |
| domain | squidscript.com | payload_delivery | 2026-09-20 | 90% |
| url | hxxps://demonsbasement.com/ | payload_delivery | 2026-09-19 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["167.235.0.162", "36.248.232.184", "103.170.217.184", "46.36.40.185", "169.58.248.162"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["167.235.0.162", "36.248.232.184", "103.170.217.184", "46.36.40.185", "169.58.248.162"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["digital.digitaldatainsights.org", "squidscript.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://167.235.0.162/api/forensics", "https://the.earth.li/~sgtatham/putty/0.85/w64/putty.exe", "http://195.24.237.240/.x/black3", "http://178.16.55.93/Bin/ScreenConnect.ClientSetup.exe", "https://squidscript.com/", "https://demonsbasement.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["28e0c4d5bc6675537ba47c6529877a3194a29585fb86477f66bf13c79252d2f0", "7d55a90710b8e79283efd756e8d3423fc23e0dcf742d6027b1a2a1b9d02a9c16", "79a47c33335fe1ed871a23cf7972652ee08a3ec0afed1c2dc6b5a8df675e153d", "ffe04bc05a56f78b1273876cf17ded8df1aa3da5a15deb17dce99a3e206eb705", "a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125", "c1c122869f46aaf8c4e90f3132c93a801c853244c756966952d0bf19241cf084", "2bcc91fdedb8c583a9fe883be9ad453333a1bba0fdf655474982db3cbb8e7a74"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Phishing Campaign Triage and Sandbox Analysis: Security analysts or threat hunters often intentionally visit suspicious URLs or download attachments from phishing emails in isolated environments (e.g., Any.Run, Joe Sandbox, or a dedicated “phishing triage” VM) to analyze behavior. If the IOC is a known URL or hash, this legitimate investigation activity will trigger the rule.
svc-sandbox, threat-hunter-01) from the alerting logic.Web Application Firewall (WAF) or Reverse Proxy Logging: In environments using tools like F5 BIG-IP, AWS CloudFront, or Nginx, legitimate traffic to external or internal staging endpoints may be logged or proxied. If the “unknown malware” IOC is a URL or IP that is actually a staging server, CDN edge, or API gateway used by CI/CD pipelines, the detection may fire on standard application traffic.
waf-node-01, nginx-proxy) when the destination matches the IOC.Scheduled Backup or Sync Jobs: Enterprise backup solutions (e.g., Veeam, Commvault, or Windows Server Backup) or file sync services (e.g., OneDrive for Business, SharePoint Online) may connect to specific endpoints or use specific hashes for delta uploads. If the IOC is a generic IP or URL that coincidentally matches a backup repository or sync endpoint, this routine task will trigger the alert.
VeeamBackup.exe, `OneDrive