This rule detects the presence of 94 network indicators of compromise (IOCs) linked to unknown malware, signaling potential lateral movement or command-and-control (C2) beaconing within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy, unclassified threats that may have evaded signature-based detections and established a foothold before traditional alerts trigger.
Malware Family: Unknown malware Total IOCs: 94 IOC Types: url, ip:port, sha256_hash, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 2[.]56[.]97[.]65:7443 | botnet_cc | 2026-09-18 | 75% |
| sha256_hash | 08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958 | payload | 2026-09-18 | 75% |
| ip:port | 179[.]199[.]143[.]63:7443 | botnet_cc | 2026-09-18 | 100% |
| domain | test.adriance.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | search.csmq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | help1.mcsq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | clean.csmq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | connect.mcfind.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | crs.defenders.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | cdn.mcsq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | src.mcfind.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | cfd.fins.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | api.federickcasto.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | api.groundexpressdispatch.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | wise.wiwgf.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | find.csmq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | open.csmq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | check.mcsq.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | rally.wiwgf.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | fly.wiwgf.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | olympic.wiwgf.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | husband.wiwgf.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | crs.aiservices.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | make.thbwi.workers.dev | payload_delivery | 2026-09-18 | 75% |
| domain | build-asdasd[.]4b3a91fd1b35ab2d023f5d71713a6c00.workers.dev | payload_delivery | 2026-09-18 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown malware
let malicious_ips = dynamic(["2.56.97.65", "172.86.126.227", "179.199.143.63"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["2.56.97.65", "172.86.126.227", "179.199.143.63"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown malware
let malicious_domains = dynamic(["test.adriance.workers.dev", "search.csmq.workers.dev", "help1.mcsq.workers.dev", "clean.csmq.workers.dev", "connect.mcfind.workers.dev", "crs.defenders.workers.dev", "cdn.mcsq.workers.dev", "src.mcfind.workers.dev", "cfd.fins.workers.dev", "api.federickcasto.workers.dev", "api.groundexpressdispatch.workers.dev", "wise.wiwgf.workers.dev", "find.csmq.workers.dev", "open.csmq.workers.dev", "check.mcsq.workers.dev", "rally.wiwgf.workers.dev", "fly.wiwgf.workers.dev", "olympic.wiwgf.workers.dev", "husband.wiwgf.workers.dev", "crs.aiservices.workers.dev", "make.thbwi.workers.dev", "build-asdasd.4b3a91fd1b35ab2d023f5d71713a6c00.workers.dev", "cup.wiwgf.workers.dev", "little.vwgze.workers.dev", "suggest.wiwgf.workers.dev", "wreck.wiwgf.workers.dev", "src.mcsq.workers.dev", "tool.wiwgf.workers.dev", "burden.aeafh.workers.dev", "cms.csmq.workers.dev", "defy.3ce7ab2da45404231f376cac66904a01.workers.dev", "pet.ncsgo.workers.dev", "t.vwgze.workers.dev", "alcohol.4b3a91fd1b35ab2d023f5d71713a6c00.workers.dev", "bulb.aeafh.workers.dev", "camp.4b3a91fd1b35ab2d023f5d71713a6c00.workers.dev", "crane.ncsgo.workers.dev", "dheya.dheya.workers.dev", "dice.1467dd4e407bdff28460ad05765f04e0.workers.dev", "fit.wiwgf.workers.dev", "grace.aeafh.workers.dev", "help.mcsq.workers.dev", "item.ikevbhm-gitch.workers.dev", "mail.wiwgf.workers.dev", "packet.mwbwu.workers.dev", "palace.mdlrh.workers.dev", "right.4b3a91fd1b35ab2d023f5d71713a6c00.workers.dev", "slam.ssybd.workers.dev", "smart.ikevbhm-gitch.workers.dev", "thank.ncsgo.workers.dev"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown malware
let malicious_urls = dynamic(["https://jsonkeeper.com/b/J0VBJ"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown malware
let malicious_hashes = dynamic(["08041fe58fe8a6333f61b77e72d939b3c2c85775aa4b9d4f7639ed87e4073958"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a new microservice using a container image built from a base layer that includes a shared library or binary hash previously observed in the wild (e.g., libssl.so or a specific node_modules dependency). The IOC matches the file hash or memory signature of a known “Unknown malware” sample, triggering an alert on the CI/CD runner or production pod.
/var/lib/docker/containers/, /var/lib/kubelet/pods/) or where the parent process is a known container runtime manager like dockerd, containerd, or crio.Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files and rotate logs on a Windows Server. The script invokes certutil or bitsadmin to download a small configuration file or update package from an internal repository, and the resulting file hash matches one of the 94 IOCs because the internal build pipeline reuses a generic binary name or hash that coincidentally matches a rare malware sample.
powershell.exe or pwsh.exe and the command line contains specific internal verbs like -File pointing to a known internal script path (e.g., C:\Scripts\Maintenance\cleanup.ps1), or where the parent process is Task Scheduler (taskschd.mgr).Scenario: A security engineer performs a manual threat hunt by downloading a sample of a known benign tool (e.g., Sysinternals suite or Wireshark) to test EDR telemetry. The tool’s installer or a specific DLL has a hash that overlaps with an IOC in the ThreatFox feed due to a common build artifact or shared dependency,