This hunt detects adversary behavior characterized by the presence of twenty-nine distinct indicators of compromise (IOCs) linked to previously unidentified malware strains that may evade standard signature-based defenses. A SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and isolate emerging threats before they establish persistence or propagate laterally across the enterprise network.
Malware Family: Unknown malware Total IOCs: 29 IOC Types: domain, url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 95[.]85[.]238[.]57:8080 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 20[.]200[.]61[.]22:443 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 132[.]145[.]210[.]148:8443 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 104[.]248[.]69[.]160:65000 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 31[.]76[.]244[.]171:5173 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 94[.]26[.]90[.]219:5173 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 188[.]227[.]87[.]118:5173 | botnet_cc | 2026-07-22 | 75% |
| url | hxxps://zaciszewbobrzy.pl/ | payload_delivery | 2026-07-22 | 90% |
| domain | alkahan.com | payload_delivery | 2026-07-22 | 75% |
| domain | octopoda.gmbh | payload_delivery | 2026-07-22 | 75% |
| domain | mark-hatch.co.uk | payload_delivery | 2026-07-22 | 75% |
| domain | rosewoodonthesound.com | payload_delivery | 2026-07-22 | 75% |
| domain | planet-grid.com | payload_delivery | 2026-07-22 | 75% |
| domain | pressao.sinprodf.org.br | payload_delivery | 2026-07-22 | 75% |
| domain | nenodescolado.com.br | payload_delivery | 2026-07-22 | 75% |
| domain | adminbyrequest.agilemtech.ae | payload_delivery | 2026-07-22 | 75% |
| domain | carmag.nl | payload_delivery | 2026-07-22 | 75% |
| url | hxxps://khaasbaatindia.com/ | payload_delivery | 2026-07-22 | 90% |
| ip:port | 43[.]164[.]191[.]203:995 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 47[.]108[.]140[.]10:65443 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 47[.]108[.]140[.]10:9849 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 8[.]141[.]118[.]254:22 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 154[.]8[.]155[.]23:8443 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 154[.]8[.]155[.]23:8080 | botnet_cc | 2026-07-22 | 100% |
| ip:port | 154[.]8[.]155[.]23:80 | botnet_cc | 2026-07-22 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["95.85.238.57", "106.52.255.211", "154.8.155.23", "94.26.90.219", "20.200.61.22", "31.76.244.171", "43.164.191.203", "47.108.140.10", "132.145.210.148", "104.248.69.160", "8.141.118.254", "188.227.87.118"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["95.85.238.57", "106.52.255.211", "154.8.155.23", "94.26.90.219", "20.200.61.22", "31.76.244.171", "43.164.191.203", "47.108.140.10", "132.145.210.148", "104.248.69.160", "8.141.118.254", "188.227.87.118"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["alkahan.com", "octopoda.gmbh", "mark-hatch.co.uk", "rosewoodonthesound.com", "planet-grid.com", "pressao.sinprodf.org.br", "nenodescolado.com.br", "adminbyrequest.agilemtech.ae", "carmag.nl"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://zaciszewbobrzy.pl/", "https://khaasbaatindia.com/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Antivirus Engine Updates: The organization’s endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) performs nightly signature updates that download and install new heuristic definitions containing unknown IOCs not yet categorized in the ThreatFox database.
MsMpEng.exe (Defender) or csagent.exe (CrowdStrike) running under the SYSTEM account during the scheduled maintenance window (e.g., 02:00–04:00 UTC).Software Deployment via Configuration Management: Automated deployment tools like SCCM (System Center Configuration Manager) or Ansible push new applications to endpoints, triggering network traffic and file creation events that match generic Unknown malware IOCs during the installation phase.
ccmexec.exe process or specific deployment job IDs (e.g., Job ID 1024) when the destination port is 8530 (SCCM) and the user context is NT AUTHORITY\SYSTEM.Third-Party Cloud Backup Agents: Enterprise backup solutions such as Veeam Agent or Acronis Cyber Protect run scheduled jobs that scan local drives and upload data to cloud repositories, generating file hashes and network connections flagged as unknown IOCs.
\Veeam\ or \Acronis\, specifically filtering for processes running under the VEEAM or ACRONIS service accounts during their configured backup windows (e.g., 09:00–17:00 local time).IT Admin Script Execution: System administrators run PowerShell scripts via Task Scheduler to perform routine maintenance, such as log rotation or registry cleanup, which may invoke external tools or download temporary files