This hunt targets the presence of Creal Stealer, a high-severity infostealer that exfiltrates sensitive data such as credentials and browser cookies, by correlating against known IOCs to identify compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect and isolate infected systems before the malware can successfully transmit stolen information to threat actors.
Malware Family: Creal Stealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 65752cdf1c2e5463a694cffd51a20732 | payload | 2026-09-04 | 95% |
| sha256_hash | 352f292ab6580214f325b4200606fb868bf5b7cfdd3b8599733389cb15a0ea1d | payload | 2026-09-04 | 95% |
| sha1_hash | e0e8c6c04ecef485b9586f930df6b666de325a54 | payload | 2026-09-04 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["65752cdf1c2e5463a694cffd51a20732", "352f292ab6580214f325b4200606fb868bf5b7cfdd3b8599733389cb15a0ea1d", "e0e8c6c04ecef485b9586f930df6b666de325a54"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses PowerShell to deploy a custom internal monitoring agent that shares a similar hash or path structure with one of the Creal Stealer IOCs (e.g., a binary named update.exe or helper.dll located in C:\Program Files\InternalTools\).
powershell.exe or pwsh.exe and the command line contains specific deployment flags (e.g., -Install, -Deploy) or originates from a known internal repository path (e.g., \\fileserver\tools\).Scenario: An IT administrator runs a scheduled task using Task Scheduler to execute a legitimate maintenance script that downloads and executes a patcher from an internal web server, which may match an IOC related to network connection patterns or specific file drops in temporary directories.
schtasks.exe or Task Scheduler and the working directory is a known administrative folder (e.g., C:\AdminScripts\ or C:\Maintenance\), or where the user account belongs to the Domain Admins or Service Accounts group.Scenario: A software vendor’s installer (e.g., Adobe Creative Cloud, Microsoft Office, or VMware Workstation) drops a helper executable in C:\Program Files (x86)\ or C:\Program Files\ that matches a known Creal Stealer hash or filename pattern due to versioning or naming conventions.
msiexec.exe, setup.exe, install.exe) and the file path resides under standard program directories (C:\Program Files\, `C:\Program Files (