This hunt targets the presence of six known indicators of compromise associated with the Unknown Loader, a malware family frequently used to establish initial footholds and execute further payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the loader from progressing to lateral movement or data exfiltration stages.
Malware Family: Unknown Loader Total IOCs: 6 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894d | payload | 2026-09-19 | 85% |
| sha256_hash | 0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7 | payload | 2026-09-19 | 85% |
| sha256_hash | d04c03df654d5cb80cd95be199b2e43337ea2f9de68addf4708fe8b73a03640f | payload | 2026-09-19 | 85% |
| sha256_hash | 06d41e963ea49632f199c7bd18d7d939dc9d8dc6c02cf7ce714b7c24fef4868e | payload | 2026-09-19 | 85% |
| sha256_hash | b98fc9f0dbc61810287e77ea978665a0b762dceea927bbffceb63fb7005149b3 | payload | 2026-09-19 | 85% |
| sha256_hash | f656b47e2337fea418a36933f173da98901d9ba4c0e05e3457ee3c59f94ad458 | payload | 2026-09-19 | 80% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["4683e6a738b43dbb5d8799bb76e60920f3d684489df1863c5c9cecf7e8e8894d", "0377328b77a71491581e34aad9f57b6d581681c614846157c0cc0de7859ce6f7", "d04c03df654d5cb80cd95be199b2e43337ea2f9de68addf4708fe8b73a03640f", "06d41e963ea49632f199c7bd18d7d939dc9d8dc6c02cf7ce714b7c24fef4868e", "b98fc9f0dbc61810287e77ea978665a0b762dceea927bbffceb63fb7005149b3", "f656b47e2337fea418a36933f173da98901d9ba4c0e05e3457ee3c59f94ad458"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legacy Application Deployment via Group Policy: An IT team deploys a legacy line-of-business application (e.g., a specific version of SAP GUI or Citrix Receiver) that uses a custom installer script or a specific DLL hash known to be associated with the “Unknown Loader” family. The installer process (msiexec.exe or setup.exe) loads the specific IOCs during the initial boot sequence.
gpupdate.exe or msiexec.exe and the command line contains the specific application name (e.g., SAPGUI or CitrixReceiver) within the Program Files directory.Third-Party Antivirus/EDR Self-Update: The enterprise EDR solution (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a scheduled self-update or component refresh. The update mechanism may download and execute a helper binary or load a specific driver/module that matches one of the 6 IOCs, particularly if the IOC is a known hash for a common update component.
FalconSensor.exe, CbService.exe, SentinelOneAgent.exe) and the action is ImageLoaded or ProcessStarted with a path under the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).Scheduled Backup Job Execution: A nightly backup job (e.g., Veeam, Commvault, or Windows Server Backup) runs via Task Scheduler. The backup agent may load specific IOCs associated with the “Unknown Loader” when initializing the backup engine or loading compression libraries. This often occurs during the 02:00-04:00 window.