ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This hunt detects adversary behavior characterized by the presence of twenty distinct indicators of compromise (IOCs) linked to previously unidentified malware strains that may evade standard signature-based defenses. A SOC team should proactively hunt for these unknown threats in Azure Sentinel to identify early-stage infections and mitigate potential lateral movement before established detection rules are updated with new signatures.

IOC Summary

Malware Family: Unknown malware Total IOCs: 20 IOC Types: domain, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`1[.]117[.]77[.]166:3232`	botnet_cc	2026-08-02	100%
ip:port	`43[.]131[.]251[.]190:8088`	botnet_cc	2026-08-02	100%
ip:port	`198[.]46[.]187[.]30:65528`	botnet_cc	2026-08-02	75%
ip:port	`178[.]16[.]55[.]237:6443`	botnet_cc	2026-08-02	75%
ip:port	`43[.]161[.]234[.]96:23`	botnet_cc	2026-08-02	100%
domain	`dmart-ny.com`	payload_delivery	2026-08-02	75%
domain	`dimatteophotography.com`	payload_delivery	2026-08-02	75%
domain	`chicagoweddingworkshop.com`	payload_delivery	2026-08-02	75%
domain	`ceou.org`	payload_delivery	2026-08-02	75%
domain	`ag.group`	payload_delivery	2026-08-02	75%
domain	`yfdiecastingaluminum.com`	payload_delivery	2026-08-02	75%
ip:port	`43[.]161[.]234[.]96:3232`	botnet_cc	2026-08-02	100%
ip:port	`101[.]37[.]210[.]236:8081`	botnet_cc	2026-08-02	100%
ip:port	`1[.]117[.]77[.]166:111`	botnet_cc	2026-08-02	100%
ip:port	`1[.]117[.]77[.]166:8082`	botnet_cc	2026-08-02	100%
ip:port	`70[.]39[.]205[.]231:3000`	botnet_cc	2026-08-02	100%
ip:port	`167[.]88[.]185[.]222:8080`	botnet_cc	2026-08-02	100%
ip:port	`167[.]88[.]185[.]222:80`	botnet_cc	2026-08-02	100%
ip:port	`167[.]88[.]185[.]222:22`	botnet_cc	2026-08-02	100%
ip:port	`167[.]88[.]185[.]222:443`	botnet_cc	2026-08-02	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["43.131.251.190", "101.37.210.236", "167.88.185.222", "43.161.234.96", "1.117.77.166", "178.16.55.237", "198.46.187.30", "70.39.205.231"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.131.251.190", "101.37.210.236", "167.88.185.222", "43.161.234.96", "1.117.77.166", "178.16.55.237", "198.46.187.30", "70.39.205.231"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["dmart-ny.com", "dimatteophotography.com", "chicagoweddingworkshop.com", "ceou.org", "ag.group", "yfdiecastingaluminum.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown malware IOCs detection rule:

Scenario: Legitimate Software Deployment via Endpoint Management Tools
- Context: When administrators use tools like Microsoft Intune, Ivanti Neurons, or Jamf Pro to push new application updates or security patches, the deployment agents often generate network traffic and file hashes that have not yet been cataloged in the ThreatFox intelligence feed. This triggers alerts for “unknown” IOCs during scheduled maintenance windows.
- Suggested Filter/Exclusion: Create an exclusion rule based on the source host group (e.g., HostGroup = "Managed_Endpoints") and the specific process names of the deployment agents (e.g., ProcessName IN ("IntuneManagementExtension.exe", "IvantiAgentService.exe")). Additionally, suppress alerts during known maintenance windows defined in the SIEM calendar.
Scenario: Scheduled Internal Data Backup Jobs
- Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault frequently run scheduled jobs that scan and transfer large datasets. These tools often utilize temporary staging files with dynamic hashes or generate network connections to backup repositories that are not yet recognized by the ThreatFox database, leading to high-volume false positives for unknown file IOCs.
- Suggested Filter/Exclusion: Implement a filter excluding traffic originating from specific backup service accounts (e.g., SourceUser = "svc_backup_admin") and destination IP ranges dedicated to the backup infrastructure (e.g., DestIP IN ("10.20.30.0/24")). Correlate alerts with the scheduled job ID in the SIEM to auto-close tickets matching active backup windows.
Scenario: Development Environment Testing of New Applications
- Context: In Dev