ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the execution of Unknown Loader indicators, which often serve as initial footholds for malware delivery and lateral movement within an Azure environment. Proactively hunting these specific IOCs in Azure Sentinel allows the SOC team to identify early-stage compromise signals before they escalate into full-blown incidents, thereby reducing detection latency and potential impact.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["abcsgftr.cc", "alkociferblat.cc", "blakcinwhitexn.cc", "gotynotbag.cc", "gugonaftikzin.cc", "hihankidaha.cc", "hilacbatoriaaa.cc", "huishuvish.cc", "infociganka.cc", "pluhabovra.info", "tue-partner-03.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Loader IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Endpoint Protection Updates via Microsoft Defender

  • Context: The Microsoft Defender Antivirus service (MsMpEng.exe) frequently downloads and executes update packages from the cloud. These updates often utilize generic loader processes that match the “Unknown Loader” signature, especially during off-hours or when new definition signatures are pushed globally.
  • Filter/Exclusion: Create a rule exclusion based on the parent process MsMpEng.exe AND the file path containing \Program Files\Windows Defender\. Additionally, exclude any IOCs where the source IP belongs to the Microsoft Update CDN range (e.g., *.update.microsoft.com).

• Scenario: Scheduled Office 365 Configuration Sync

  • Context: The Office Client Service (OfficeClickToRun.exe) runs scheduled jobs to synchronize configuration settings and download feature updates. These background tasks often spawn temporary loader processes that fetch manifests from the Azure Content Delivery Network, triggering the Unknown Loader detection logic due to dynamic hash generation of new update components.
  • Filter/Exclusion: Exclude alerts where the process name is OfficeClickToRun.exe or OsfClient.exe. Implement a time-based filter to suppress these detections during known maintenance windows (e.g., 02:00–04:00 local time) when bulk syncs occur.

• Scenario: Enterprise Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents (ccmexec.exe or Microsoft.IntuneManagementAgent) frequently deploy software updates and patches to endpoints. The deployment engine utilizes a generic loader component to unpack and install new applications, which often matches the IOCs associated