ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis targets the execution of the “Unknown Loader” malware, a high-severity threat that often serves as an initial foothold for further post-exploitation activities. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, potentially preventing the loader from establishing persistence or downloading additional payloads before traditional detections trigger.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain, sha256_hash

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["fallport.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["9d08b2f19f1f239652d9fc41500348262101a1fb88b2f9dc1dfe93d54b73d88d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A DevOps engineer uses a custom Python script to download and execute a build artifact from an internal artifact repository (e.g., Artifactory or Nexus) that is hosted on an IP address or domain recently flagged by ThreatFox due to a shared hosting provider or transient DNS resolution.
  • Filter/Exclusion: Exclude processes initiated by known build agents (e.g., jenkins.exe, gitlab-runner, teamcity-agent) or filter for parent processes that are part of the CI/CD pipeline (e.g., java.exe running the agent).
• Scenario: An IT administrator performs a manual patch deployment using a third-party tool like Ninite or a custom PowerShell script that downloads installers from a public CDN or mirror site, where the specific IP or domain has been temporarily associated with the “Unknown Loader” cluster in the ThreatFox feed.
  • Filter/Exclusion: Exclude events where the initiating user belongs to the IT_Admins or Patch_Managers security group, or filter for known administrative tools like ninite.exe or powershell.exe executing from the C:\Program Files\Admin Tools directory.
• Scenario: A security team conducts a live-fire exercise or a threat hunt simulation using a known benign loader script (e.g., a PowerShell one-liner) to test detection coverage, where the script’s download source matches one of the two IOCs in the hunt package.
  • Filter/Exclusion: Exclude events tagged with a custom metadata field ThreatHunt=true or filter for parent processes that are part of the security tooling suite (e.g., splunkforwarder.exe, crowdagent.exe, or specific test harness executables).
• Scenario: A legacy application installer (e.g., for a specific vendor’s SDK or driver) uses a hardcoded URL to fetch components from