ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This hypothesis targets the execution of known indicators of compromise associated with the “Unknown Loader” malware family, which often serves as an initial access vector for deploying more sophisticated payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the loader can establish persistence or exfiltrate data, reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 7 IOC Types: sha256_hash, url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Loader
let malicious_urls = dynamic(["https://scan.cyberessentials.live/usersc/testfiles/macro/CEPlus.docm"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Loader
let malicious_hashes = dynamic(["e38c53aedf49017c47725e4912fc7560e1c8ece2633c05057b22fd4a8ed28eb3", "b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08", "a2fa794887ecb96a4b40389fe152e52707c021c86f63c4430557e7c286840b96", "b1bb369c12b3c9576d2178f448cfc174387aad27a90b34f678574b6b6c41471e", "d2c6627cb199c0c7004919590b820605b1091f7c4741b791258d8f54183105f5", "d3e8a9c00b37f1366f12587d2be7e4b0f3dc9d8f9433ec9e3f8908e11426ca1b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

• Legacy Application Deployment via MSI/EXE Installers: Many enterprise applications (e.g., Adobe Creative Suite, Oracle Java, or internal legacy tools) use installers that may contain binary hashes or file paths matching known “Unknown Loader” IOCs due to shared dependencies or generic naming conventions.
  • Filter: Exclude processes where the parent is msiexec.exe or setup.exe and the image path resides in standard installation directories like C:\Program Files\ or C:\Program Files (x86)\, provided the user is part of a trusted “AppDeploy” AD group.
• Antivirus/EDR Self-Update or Scan Operations: Security tools like CrowdStrike Falcon, Microsoft Defender, or SentinelOne often spawn temporary helper processes or download update packages that may match IOCs for loaders, especially if the update package is signed by a third-party vendor not explicitly whitelisted.
  • Filter: Exclude events where the process name matches known security tool binaries (e.g., FalconSensor.exe, MsMpEng.exe, SentinelOneAgent.exe) or where the parent process is the main agent executable, and the file path is within the vendor’s installation directory.
• Scheduled Backup or Archive Jobs: Tools like Veeam, Commvault, or Acronis may create temporary staging files or use helper executables for compression/extraction that could inadvertently match loader IOCs, particularly if the job runs under a service account with broad file access.
  • Filter: Exclude processes initiated by scheduled tasks with names containing “Backup,” “Archive,” or “Snapshot,” and where the user account belongs to a “BackupService” AD group, limiting the exclusion to specific backup server hosts.
• Development Build Agents (CI/CD): In DevOps environments, build agents (e.g., Azure DevOps Agent, Jenkins Node, or Git