This hypothesis targets the presence of specific network indicators of compromise linked to unknown malware, suggesting that an adversary may have established a foothold or exfiltration channel within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the unknown malware can propagate or execute further malicious actions.
Malware Family: Unknown malware Total IOCs: 10 IOC Types: ip:port, url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxps://uaepi.com/ | payload_delivery | 2026-09-23 | 90% |
| url | hxxps://www.tudosobrecavalos.com/ | payload_delivery | 2026-09-23 | 90% |
| ip:port | 64[.]227[.]178[.]198:7443 | botnet_cc | 2026-09-23 | 75% |
| url | hxxps://williamcleans.de/ | payload_delivery | 2026-09-23 | 90% |
| url | hxxps://vivianemoura.com.br/ | payload_delivery | 2026-09-23 | 90% |
| ip:port | 27[.]14[.]2[.]173:8081 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 27[.]14[.]2[.]173:8888 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 27[.]14[.]2[.]173:2053 | botnet_cc | 2026-09-23 | 100% |
| ip:port | 27[.]14[.]2[.]173:22 | botnet_cc | 2026-09-23 | 100% |
| url | hxxps://owlabc.net/ | payload_delivery | 2026-09-23 | 90% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["64.227.178.198", "27.14.2.173"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.227.178.198", "27.14.2.173"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://uaepi.com/", "https://www.tudosobrecavalos.com/", "https://williamcleans.de/", "https://vivianemoura.com.br/", "https://owlabc.net/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses curl or wget to download a specific build artifact or dependency from a staging repository that has a known, transient hash collision with one of the 10 IOCs (e.g., a SHA256 match due to a generic packaging tool like docker build or npm pack).
curl, wget, or powershell and the command line contains staging.internal or artifacts.azure.com. Alternatively, exclude file paths located in standard build directories like C:\Builds\ or /tmp/builds/.Scenario: An IT administrator runs a scheduled PowerShell script to deploy a custom internal utility or patch that was compiled with a specific version of a compiler (e.g., gcc or msvc) resulting in a binary hash that matches an IOC associated with a known loader. The script is executed by Task Scheduler or cron on multiple endpoints.
powershell.exe or pwsh.exe and the parent process is svchost.exe (indicating Task Scheduler) or cron. Additionally, exclude file paths under C:\ProgramData\InternalTools\ or /opt/internal/bin/.Scenario: A security team performs a controlled test or uses a tool like Sysinternals (e.g., PsExec or Process Monitor) to copy a test file to a remote machine. The test file is a known benign binary (e.g., notepad.exe or a custom test DLL) that has a hash matching one of the IOCs due to a common distribution method.