This hunt targets the presence of 49 known indicators of compromise associated with the Unknown Loader, a tool frequently used by adversaries to establish initial footholds and execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the loader can fully establish persistence or escalate privileges, thereby reducing the mean time to detection for high-severity threats.
Malware Family: Unknown Loader Total IOCs: 49 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | nomadtrick.com | payload_delivery | 2026-09-23 | 75% |
| domain | novapost.com.br | payload_delivery | 2026-09-23 | 75% |
| domain | obenginetech.com | payload_delivery | 2026-09-23 | 75% |
| domain | otcrypto.com | payload_delivery | 2026-09-23 | 75% |
| domain | pwa.com.au | payload_delivery | 2026-09-23 | 75% |
| domain | quickcamps.com.au | payload_delivery | 2026-09-23 | 75% |
| domain | rightbrainiq.com | payload_delivery | 2026-09-23 | 75% |
| domain | saroutbladi.com | payload_delivery | 2026-09-23 | 75% |
| domain | shogi-pineapple.com | payload_delivery | 2026-09-23 | 75% |
| domain | stagiimedicale.econyouth.ro | payload_delivery | 2026-09-23 | 75% |
| domain | swiftwalve.com | payload_delivery | 2026-09-23 | 75% |
| domain | teamdkskarate.com | payload_delivery | 2026-09-23 | 75% |
| domain | themespartner.com | payload_delivery | 2026-09-23 | 75% |
| domain | villamaribor.com | payload_delivery | 2026-09-23 | 75% |
| domain | vincenzomigliaccio.com | payload_delivery | 2026-09-23 | 75% |
| domain | weadvocacy.fr | payload_delivery | 2026-09-23 | 75% |
| domain | wordfluxa.com | payload_delivery | 2026-09-23 | 75% |
| domain | yassinemoujan.com | payload_delivery | 2026-09-23 | 75% |
| domain | zikrulbestari.co.id | payload_delivery | 2026-09-23 | 75% |
| domain | codesens.pl | payload_delivery | 2026-09-23 | 75% |
| domain | custompatchmakers.ca | payload_delivery | 2026-09-23 | 75% |
| domain | cybercladconsulting.com | payload_delivery | 2026-09-23 | 75% |
| domain | deltacollectionusa.com | payload_delivery | 2026-09-23 | 75% |
| domain | denzelcreation.com | payload_delivery | 2026-09-23 | 75% |
| domain | elles.agency | payload_delivery | 2026-09-23 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["nomadtrick.com", "novapost.com.br", "obenginetech.com", "otcrypto.com", "pwa.com.au", "quickcamps.com.au", "rightbrainiq.com", "saroutbladi.com", "shogi-pineapple.com", "stagiimedicale.econyouth.ro", "swiftwalve.com", "teamdkskarate.com", "themespartner.com", "villamaribor.com", "vincenzomigliaccio.com", "weadvocacy.fr", "wordfluxa.com", "yassinemoujan.com", "zikrulbestari.co.id", "codesens.pl", "custompatchmakers.ca", "cybercladconsulting.com", "deltacollectionusa.com", "denzelcreation.com", "elles.agency", "evosolis.it", "fansly.ca", "fashionenters.com", "fenos.be", "fertilizerproductionlines.com", "gayimi.com", "healthierclubs.com", "izrasports.com", "jcgsac.org", "kmmlf.com", "lap-box.com", "lb-arc.co.il", "manojtextilemathura.com", "marissalloyd.com", "maurobrunettimusica.com", "moderncraz.com", "agluxuryinteriors.co.uk", "annastiftung.ch", "antaracruises.in", "baudersmarketing.com", "blueshieldiaq.com", "blueskywater.com.tr", "brightsforge.com", "castromacdonald.cl"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Jenkins or GitLab CI that pulls and executes a custom build agent binary from a private registry. The specific version hash of this agent matches one of the 49 IOCs in the ThreatFox package, triggering an alert during routine nightly builds.
C:\Program Files\Jenkins\agent\ or C:\GitLab\runner\ and the parent process is java.exe or gitlab-runner.exe.Task Scheduler to patch a legacy application using a standalone installer downloaded from the vendor’s portal. The installer’s SHA256 hash coincides with an IOC associated with the Unknown Loader, but the execution is initiated by svchost.exe (Task Scheduler service) and the file resides in C:\Temp\Patches\.
svchost.exe and the file path contains C:\Temp\Patches\ or C:\Windows\Temp\, provided the user context is a known service account (e.g., DOMAIN\svc-patching).7-Zip or a specific Chrome update) to validate endpoint detection coverage. The sample’s hash matches an IOC in the package, but the execution occurs in an isolated sandbox VM or a dedicated test user profile.
G_Security_Testing or the file path is located under C:\Users\sec-test\Downloads\ and the process