ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt targets the execution of known IOCs associated with the “Unknown Loader” to identify potential initial access or payload delivery mechanisms that may have bypassed standard endpoint detections. Proactively hunting for these indicators in Azure Sentinel is critical because high-severity loader activity often serves as a precursor to deeper compromise, allowing the SOC to isolate affected assets before lateral movement or privilege escalation occurs.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: url, sha256_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["http://66.179.30.146:443/?h=66.179.30.146&p=443&t=tcp&a=w64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["f7e67c3bfcee9cd325706f49b71e4b1992a1f652ec253c96533c41d2946dfbdb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A DevOps engineer uses Ansible or Terraform to provision new Linux instances, where the initialization scripts download and execute a generic init.sh or bootstrap.sh from an internal artifact repository (e.g., Artifactory or Nexus). If the hash or URL of this script matches the “Unknown Loader” IOC due to a shared build artifact or a generic naming convention, the rule triggers.
  • Filter/Exclusion: Exclude processes where the parent is ansible-playbook or terraform, and the command line contains bash or sh executing a script from a known internal path (e.g., /opt/provisioning/ or /usr/local/bin/init/).
• Scenario: An IT administrator runs WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) to deploy a new software package. The deployment agent (ccmexec.exe or wuauclt.exe) downloads a .msi or .exe installer from the distribution point and executes it. If the installer is a generic wrapper or has a hash that coincidentally matches the IOC (common with open-source installers or repackaged tools), the detection fires.
  • Filter/Exclusion: Exclude executions where the parent process is ccmexec.exe, wuauclt.exe, or svchost.exe (with wuauserv service), and the file path resides under C:\Windows\Installer\ or C:\ProgramData\Microsoft\....
• Scenario: A data engineering team uses Apache Airflow or Dagster to run ETL jobs. The task executor downloads a small Python utility script (e.g., data_cleaner.py or loader.py) from a Git repository or S3 bucket and executes it via python3. If