ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection rule identifies potential initial access and execution activities by correlating known indicators of compromise (IOCs) linked to the “Unknown Loader” threat actor within Azure Sentinel logs. Proactively hunting for these specific IOCs is critical because Unknown Loader often serves as a precursor to advanced persistent threats, allowing the SOC team to intercept early-stage infections before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["mittenmint.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["https://vokhmiwmncjba.vivaldinotabot.com/s/psc4?cl"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown Loader IOCs detection rule:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: During enterprise-wide patching cycles, tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often download and execute temporary loader scripts to install updates. These scripts may generate new IOCs that have not yet been whitelisted in the ThreatFox intelligence feed.
  • Filter/Exclusion: Exclude process paths containing C:\Windows\CCM\ or C:\Program Files (x86)\Microsoft Intune Agent\. Additionally, add a filter to ignore alerts where the parent process is ccmsetup.exe or IntuneManagementExtension.exe.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently run scheduled jobs (e.g., every 4 hours) to download and load new signature definitions. These loaders often utilize temporary executables that appear “unknown” until the next intelligence sync cycle completes.
  • Filter/Exclusion: Create a rule exclusion based on known vendor hashes or process names. For example, exclude alerts where the executable name matches C:\Program Files\CrowdStrike\Falcon Sensor\CrowdStrike.exe (or equivalent for SentinelOne) and the action is “Update” during standard maintenance windows (e.g., 02:00–04:00).

• Scenario: Third-Party SaaS Connector Installations

  • Context: IT administrators often deploy new connectors or agents for cloud services like Okta, Zoom, or ServiceNow. These installations frequently involve a generic “loader” executable that initializes the agent before handing off to the main service, triggering an unknown IOC alert