ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating 16 specific indicators of compromise that may evade traditional signature-based defenses. Proactively hunting for these IOCs in Azure Sentinel is critical to uncover stealthy threats early, allowing the SOC team to isolate affected assets before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Unknown malware Total IOCs: 16 IOC Types: ip:port, url, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`175[.]43[.]223[.]196:7443`	botnet_cc	2026-08-12	75%
ip:port	`107[.]22[.]41[.]214:7443`	botnet_cc	2026-08-12	75%
url	`hxxps://pacificrimindustries.com.au/`	payload_delivery	2026-08-12	90%
ip:port	`113[.]44[.]90[.]0:8788`	botnet_cc	2026-08-12	100%
domain	`pacificrimindustries.com.au`	payload_delivery	2026-08-12	75%
ip:port	`207[.]180[.]58[.]21:7000`	botnet_cc	2026-08-12	75%
url	`hxxps://inelloelectric.com/`	payload_delivery	2026-08-12	90%
url	`hxxps://maletosr.world/`	payload_delivery	2026-08-12	90%
domain	`thu-ipad-02.cfd`	payload_delivery	2026-08-12	100%
ip:port	`140[.]82[.]46[.]246:7443`	botnet_cc	2026-08-12	100%
url	`hxxps://neihite.cc/gate/chunk`	botnet_cc	2026-08-12	100%
url	`hxxps://neihite.cc/gate/handshake`	botnet_cc	2026-08-12	100%
url	`hxxps://neihite.cc/gate/complete`	botnet_cc	2026-08-12	100%
domain	`neihite.cc`	botnet_cc	2026-08-12	100%
domain	`psc-io.com`	payload_delivery	2026-08-12	75%
domain	`choosedigital.com.au`	payload_delivery	2026-08-12	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["175.43.223.196", "113.44.90.0", "107.22.41.214", "207.180.58.21", "140.82.46.246"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["175.43.223.196", "113.44.90.0", "107.22.41.214", "207.180.58.21", "140.82.46.246"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["pacificrimindustries.com.au", "thu-ipad-02.cfd", "neihite.cc", "psc-io.com", "choosedigital.com.au"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://pacificrimindustries.com.au/", "https://inelloelectric.com/", "https://maletosr.world/", "https://neihite.cc/gate/chunk", "https://neihite.cc/gate/handshake", "https://neihite.cc/gate/complete"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Security Tool Updates
- Context: The endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads new definition packs or heuristic updates. These packages often contain newly compiled binaries with fresh hashes that do not yet exist in the global ThreatFox threat intelligence feed, triggering an “Unknown” alert.
- Filter/Exclusion: Create a whitelist exclusion based on the specific process name and parent path of the security agent updater (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Windows\System32\MpCmdRun.exe). Additionally, exclude IOCs generated during the standard maintenance window (e.g., 01:00–04:00 UTC).
Scenario: Internal Development Build Deployment
- Context: The DevOps team deploys a new internal application build via CI/CD pipelines (using tools like Jenkins or Azure DevOps) to the production environment. These custom-built executables have unique hashes that are not yet indexed in external threat intelligence databases, causing them to be flagged as unknown malware IOCs.
- Filter/Exclusion: Implement a filter that excludes IOCs originating from specific internal IP ranges (e.g., 10.20.x.x for the DevOps subnet) or process paths located within the development directory structure (e.g., C:\Builds\InternalApps\).
Scenario: Scheduled Enterprise Backup Jobs
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault run scheduled jobs that spawn temporary helper processes to scan and archive data. These transient processes often generate new network