ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving unknown loader processes that may indicate early-stage malware execution or command-and-control communication within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical to intercept potential threats before they escalate into full-blown incidents by revealing hidden persistence mechanisms and anomalous network behaviors.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["cooldogshistory.com", "ilikegoodpersontoo.com", "godhelp-us.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, along with targeted filters and exclusions to reduce noise in an enterprise environment:

• Scenario: Scheduled Antivirus Definitions Update via Local Service Account

  • Context: The local SYSTEM account or a dedicated service account (e.g., svc_antivirus) triggers the “Unknown Loader” behavior when updating virus definitions. This often involves downloading and executing new definition packages from vendors like Microsoft Defender, Symantec Endpoint Protection, or CrowdStrike.
  • Filter/Exclusion: Exclude processes where the Process Name is MpCmdRun.exe, ccSetCmd.exe, or csagent.exe AND the User Account matches known service accounts (e.g., NT SYSTEM, svc_antivirus). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 daily).

• Scenario: Deployment of New Applications via Configuration Management Tools

  • Context: Automated deployment tools such as Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Ansible Tower frequently install new software packages. These tools often use a generic loader process to unpack and execute installation binaries, which may not yet be in the ThreatFox known signature database.
  • Filter/Exclusion: Create an exclusion rule for Process Name matching known deployment agents (e.g., ccmsetup.exe, ivanti_agent_service.exe) where the Parent Process is a recognized orchestration tool. Alternatively, whitelist specific file paths under the enterprise software distribution directory (e.g., C:\Program Files\Microsoft Configuration Manager).

• Scenario: Execution of Custom PowerShell Scripts by Administrators

  • Context: System administrators frequently run ad-h