This hypothesis targets the execution of the Unknown Loader, a malicious component frequently observed in initial access and lateral movement campaigns, by correlating its specific IOCs against endpoint and network telemetry. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised assets early, as the loader often serves as a precursor to more complex post-exploitation activities that may evade standard signature-based detections.
Malware Family: Unknown Loader Total IOCs: 4 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | ikshop.lk | payload_delivery | 2026-09-26 | 75% |
| domain | 13games.net | payload_delivery | 2026-09-26 | 75% |
| domain | fishing-tech.com | payload_delivery | 2026-09-26 | 75% |
| domain | 1-1video.com | payload_delivery | 2026-09-26 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["ikshop.lk", "13games.net", "fishing-tech.com", "1-1video.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Legitimate Software Updates via Third-Party Patches: When enterprise patch management tools like WSUS or SCCM deploy updates for legacy applications that bundle specific installer components, the resulting binary hashes or file paths may match the “Unknown Loader” IOCs if the loader is a common dependency (e.g., a specific version of msiexec wrapper or a custom installer stub).
svc-patch, admin-sccm) or filter by parent process names such as wuaex.exe, ccmexec.exe, or w32time.exe when the IOC is a file hash or path match.Scheduled Maintenance Jobs for Log Rotation or Cleanup: Scheduled tasks created by IT operations to run cleanup scripts (e.g., using Task Scheduler to execute cleanlogs.ps1 or rotate.sh) might place temporary executable files in standard temp directories (%TEMP%, C:\Windows\Temp) that match the file path or hash IOCs if the loader is a generic utility binary.
svchost.exe (specifically the Task Scheduler service) or schtasks.exe, and restrict the file path exclusion to known maintenance directories like C:\ProgramData\CorpOps\ or C:\Scripts\Maintenance\.Development or QA Environments Running Containerized Workloads: In DevOps pipelines, Docker or Kubernetes pods may mount volumes containing build artifacts or test binaries that match the “Unknown Loader” IOCs, especially if the loader is a common build tool (e.g., make, cmake, or a specific version of node or python interpreter) used in CI/CD jobs.
*