ThreatFox: FaceStealer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior consistent with the FaceStealer malware campaign by monitoring for three specific Indicators of Compromise (IOCs) that signal active credential theft and lateral movement attempts. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints before attackers can exfiltrate sensitive data or establish persistent access through stolen credentials.

IOC Summary

Malware Family: FaceStealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`fc2f88f368a32c8ba7257bd54a830068`	payload	2026-08-15	95%
sha1_hash	`c81953bb0d5bf418cc1b84ed0dd0027ab448ee0f`	payload	2026-08-15	95%
sha256_hash	`6702d4f508ebf248a56bb2d14b1afdc8557398b3b94c25a6d23eb61533647373`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - FaceStealer
let malicious_hashes = dynamic(["fc2f88f368a32c8ba7257bd54a830068", "c81953bb0d5bf418cc1b84ed0dd0027ab448ee0f", "6702d4f508ebf248a56bb2d14b1afdc8557398b3b94c25a6d23eb61533647373"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — FaceStealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: FaceStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s primary EDR solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled deep scan of the C:\ProgramData\Quarantine directory. This process extracts and analyzes archived malware samples, including previous FaceStealer variants stored in the quarantine vault, triggering the detection against known IOCs found within these static archives rather than active infection.
- Filter/Exclusion: Exclude file paths matching *\\Quarantine\\*.zip, *\\Quarantine\\*.cab, or specific EDR service accounts (e.g., MSSQL$SERVICE, DefenderSvc) from the rule when the process name is MsMpEng.exe or FalconSensor.exe.
SIEM Log Ingestion of Threat Intelligence Feeds
- Scenario: The Security Information and Event Management (SIEM) system (e.g., Splunk, Sentinel, or QRadar) ingests raw threat intelligence feeds from a third-party provider. During the ETL process, the ingestion pipeline parses JSON files containing FaceStealer IOCs for enrichment purposes. The detection logic mistakenly interprets these “read-only” parsing events as active network traffic or file creation events generated by the IOCs themselves.
- Filter/Exclusion: Add a condition to exclude events where the Source Host is the SIEM collector node (e.g., hostname: siem-collector-01) and the Event Type is “Ingestion” or “Enrichment,” ensuring only host-generated telemetry triggers alerts.
Scheduled Backup Jobs on Shared Network Drives