ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis targets the execution of the Unknown Loader, a tool frequently used by adversaries to establish initial footholds and facilitate further payload delivery. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints before the loader can progress to lateral movement or privilege escalation, thereby reducing the overall dwell time of the threat.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["friendsanchor.xyz", "doctorboundary.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Scenario: A security team or DevOps engineer manually downloads the “Unknown Loader” sample (e.g., loader.exe) from a threat intelligence feed or internal share for analysis, testing, or signature development. The file is executed in a sandboxed VM or isolated host, triggering the IOC match.

  • Filter/Exclusion: Exclude hosts tagged with Sandbox, Lab, or Test in the CMDB or asset inventory. Additionally, exclude execution paths under specific analysis directories like C:\ThreatIntel\ or D:\Samples\.

• Scenario: An automated backup or snapshot job (e.g., Veeam, Commvault, or Windows Server Backup) creates a temporary copy of a user profile or application directory that contains a previously downloaded but benign file matching the loader’s hash or name. The backup agent or restore process briefly executes or touches the file, causing a detection.

  • Filter/Exclusion: Exclude processes initiated by known backup agents (e.g., vssadmin.exe, wbadmin.exe, vwr.exe) or exclude file paths within standard backup staging areas (e.g., C:\ProgramData\Veeam\, C:\Backup\).

• Scenario: A software vendor’s installer or update mechanism (e.g., Adobe Creative Cloud, JetBrains Toolbox, or a custom internal app) bundles a helper executable that shares the same filename or hash as the “Unknown Loader” IOC due to poor naming conventions or shared code libraries. The installer runs this helper during a scheduled patching window.

  • Filter/Exclusion: Correlate the detection with the parent process. If the parent process is a known installer (e.g., msiexec.exe, setup.exe, installer.exe) or belongs to a trusted vendor’s directory (e.g., C:\Program Files\Adobe\, `C:\