This hypothesis targets the presence of known indicators of compromise associated with Creal Stealer, a malicious tool frequently used to exfiltrate sensitive data and credentials from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify potential intrusions early, mitigating the risk of data theft before the adversary establishes persistence or escalates privileges.
Malware Family: Creal Stealer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | f0ac5a212ee1e3acb68b27dfdd8e3b9f46be4d6d49ec0e843b2c0cb832145873 | payload | 2026-09-10 | 95% |
| sha1_hash | f03f8bf1cab0a3772864c37678ec54d411fa1ff3 | payload | 2026-09-10 | 95% |
| md5_hash | 90606f943f0360cda289735b31ef836f | payload | 2026-09-10 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["f0ac5a212ee1e3acb68b27dfdd8e3b9f46be4d6d49ec0e843b2c0cb832145873", "f03f8bf1cab0a3772864c37678ec54d411fa1ff3", "90606f943f0360cda289735b31ef836f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a custom PowerShell script to audit and clean up temporary files in the %TEMP% directory across a fleet of build servers, specifically targeting files with the .tmp extension that match a specific hash pattern used by the Creal Stealer IOC list.
powershell.exe or pwsh.exe and the command line contains keywords like Remove-Item, Get-ChildItem, or Test-Path combined with the specific IOC hash or filename pattern, provided the parent process is a known CI/CD agent (e.g., jenkins.exe, gitlab-runner, azure-pipelines-agent).Scenario: An endpoint protection vendor (e.g., CrowdStrike, SentinelOne) performs a scheduled “deep scan” or “threat hunt” job that explicitly loads the Creal Stealer YARA rule or IOC list to verify detection coverage on critical domain controllers.
FalconSensor.exe, SentinelOne.exe, Defender.exe) and the event type is “Rule Load” or “Scan Start” rather than “File Create” or “Process Start,” or where the parent process is the vendor’s management console.Scenario: A security engineer manually tests the Creal Stealer detection logic by creating a benign test file (e.g., creal_test.bin) with the specific IOC hash in a sandboxed VM or a dedicated test server, then deleting it after verification.
Environment=Test, Role=Sandbox, or Tag=ThreatHunt, or where the user account is a known service account used for