ThreatFox: Unknown Loader IOCs

Hunt Hypothesis

This detection identifies suspicious activity linked to the Unknown Loader malware by monitoring specific indicators of compromise that often signal initial access or lateral movement attempts within an Azure environment. Proactively hunting for these IOCs in Azure Sentinel is critical because Unknown Loader frequently serves as a precursor to advanced persistent threats, allowing the SOC team to intercept potential compromises before they escalate into full-scale incidents.

IOC Summary

Malware Family: Unknown Loader Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Loader
let malicious_domains = dynamic(["structuredolls.xyz", "songsbeginner.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Loader

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Unknown Loader IOCs rule:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: Enterprise Configuration Management tools like Microsoft System Center Configuration Manager (SCCM) or Microsoft Intune frequently push new applications to endpoints. These deployments often utilize temporary, unsigned loader scripts or installers that have not yet been ingested into the ThreatFox reputation database, triggering “Unknown Loader” alerts during mass rollout windows.
  • Filter/Exclusion: Exclude processes originating from ccmsetup.exe, Microsoft.IntuneManagementAgent.exe, and their child processes when running under the SYSTEM or specific Service Accounts (e.g., DOMAIN\SCCM-Deploy). Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled PowerShell Maintenance Scripts

  • Context: IT Operations teams often schedule complex PowerShell scripts via Windows Task Scheduler to perform routine maintenance (log rotation, disk cleanup, registry updates). These scripts frequently invoke powershell.exe which then loads dynamic modules or external DLLs that appear as “Unknown” loaders because they are custom internal tools not yet whitelisted in the threat intelligence feed.
  • Filter/Exclusion: Create an exclusion for powershell.exe processes where the command line contains specific keywords (e.g., -ExecutionPolicy Bypass, -File C:\Scripts\). Furthermore, exclude alerts triggered by Task Scheduler tasks with names containing “Maintenance,” “Cleanup,” or “Backup” owned by the built-in SYSTEM account.

• Scenario: Third-Party Endpoint Protection Scans

  • Context: During on-demand or scheduled scans, third-party antivirus solutions (such as CrowdStrike Falcon, McAfee Enterprise, or Sentinel