ThreatFox: Unknown malware IOCs

Hunt Hypothesis

This detection rule identifies potential unknown malware infections by correlating five specific Indicators of Compromise (IOCs) that may represent novel threats not yet covered by existing signatures. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly isolate and analyze emerging malicious artifacts before they establish persistence or propagate across the enterprise network.

IOC Summary

Malware Family: Unknown malware Total IOCs: 5 IOC Types: ip:port, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	`43[.]206[.]219[.]14:10002`	botnet_cc	2026-07-29	75%
ip:port	`169[.]58[.]50[.]199:7443`	botnet_cc	2026-07-29	75%
url	`hxxps://cheloks.pro/`	payload_delivery	2026-07-29	90%
url	`hxxps://maletoks.pro/`	payload_delivery	2026-07-29	90%
url	`hxxps://lokripi.icu/`	payload_delivery	2026-07-29	90%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["43.206.219.14", "169.58.50.199"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["43.206.219.14", "169.58.50.199"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://cheloks.pro/", "https://maletoks.pro/", "https://lokripi.icu/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown malware

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown malware IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Endpoint Protection Policy Updates via Scheduled Tasks
- Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, executes a nightly scheduled task to pull the latest definition updates. These updates often contain new hash signatures that have not yet been ingested into the ThreatFox threat intelligence platform, causing them to appear as “unknown” IOCs during the initial scan window.
- Filter/Exclusion: Create an exclusion rule for processes running under the specific service accounts associated with the EDR agent (e.g., System or NT SERVICE\DefenderSvc). Additionally, filter out alerts occurring within a 15-minute window following the scheduled update job time (e.g., between 02:00 and 03:00 UTC).
Software Deployment via Configuration Management Tools
- Scenario: The IT Operations team utilizes Microsoft SCCM (Configuration Manager) or Ansible to push a new application version (e.g., Adobe Acrobat Pro) to a pilot group of workstations. The installer executable and its associated DLLs represent new binaries that do not yet exist in the ThreatFox database, triggering multiple unknown IOCs across the deployment batch.
- Filter/Exclusion: Implement a filter based on the “Installer” process name (e.g., setup.exe or msiexec.exe) running under the context of the deployment service account (DOMAIN\SCCM_SVC). Exclude alerts where the file path matches the standard software distribution directory (e.g., C:\Program Files\Apps\Staging\).
Automated Backup and Archiving Jobs