ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis targets adversaries leveraging the Unknown Loader to execute initial payload delivery and establish persistence through its specific Indicators of Compromise (IOCs). Proactive hunting in Azure Sentinel is critical because early detection of these IOCs allows the SOC team to identify stealthy command-and-control communications before they escalate into full-scale lateral movement or data exfiltration.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["fsdmkfskdojyttt.pro"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["https://workwardrobes.lk/wp-footerblog.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown Loader IOCs detection rule in an enterprise environment:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently download and execute unknown loader scripts (e.g., msiexec.exe, wusa.exe) to deploy patches or new applications. These often generate IOCs that match the “Unknown Loader” signature due to dynamic hash generation during the first run of a new package.
  • Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe (SCCM) or Microsoft.IntuneManagementService.exe, and filter out events occurring within the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs to download and install the latest definition updates. These loaders often execute from temporary directories with unique hashes that have not yet been whitelisted in the threat intelligence feed.
  • Filter/Exclusion: Create a rule exclusion based on the file path containing \Program Files\ or \Windows\System32\ combined with known vendor names (e.g., CrowdStrike, SentinelOne, Microsoft Defender). Additionally, exclude IOCs where the file age is less than 7 days and the process name matches standard update service executables.

• Scenario: Developer Build Pipelines on CI/CD Agents

  • Context: In environments with internal DevOps pipelines (e.g., Jenkins, GitLab Runner), build agents frequently compile code or run containerized tests using temporary loader scripts to inject dependencies. These transient processes often