ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to Stealer malware by monitoring specific indicators of compromise (IOCs) that signal potential credential theft and data exfiltration attempts. A proactive hunt is essential within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before sensitive information is fully extracted from the environment.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`40ee71fb1e584d320db1dcbc71e8b00a2b1b0cac`	payload	2026-08-15	95%
md5_hash	`84412c10b460870f3f9a5db8df5c4fb1`	payload	2026-08-15	95%
sha256_hash	`d4aaf92e411b242f454647d7a6d1b3657a4699e419b273e7e4b63ce4d2cccb3c`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["40ee71fb1e584d320db1dcbc71e8b00a2b1b0cac", "84412c10b460870f3f9a5db8df5c4fb1", "d4aaf92e411b242f454647d7a6d1b3657a4699e419b273e7e4b63ce4d2cccb3c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: stealler IOCs detection rule:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint periodically scan their own quarantine folders. If a previously quarantined Stealer sample exists in the archive, the EDR engine may re-scan it, triggering network connections to the known IOCs associated with that specific malware family during routine maintenance windows.
- Filter/Exclusion: Exclude traffic originating from the EDR service accounts (e.g., svc-crowdstrike, MsiInstaller) or filter alerts where the source process is the EDR agent executable itself (e.g., C:\Program Files\CrowdStrike\fsagent.exe).
Security Information and Event Management (SIEM) Log Ingestion
- Scenario: A centralized SIEM platform such as Splunk Enterprise or IBM QRadar runs scheduled jobs to ingest threat intelligence feeds. If the ingestion pipeline pulls raw data from a ThreatFox feed containing Stealer IOCs, the internal parsing service may generate network requests matching these indicators while processing logs, mimicking an active infection.
- Filter/Exclusion: Create a rule exclusion for processes running on SIEM servers (e.g., java.exe within the Splunk directory or splunkd.exe) and filter by specific scheduled job IDs associated with “Threat Intel Ingestion.”
Automated Threat Intelligence Platform Updates
- Scenario: Internal security orchestration tools like Tenable.io or Qualys Cloud Agent perform daily updates to their local IOC databases. During these update cycles, the agents connect to external threat intelligence repositories that may host Stealer signatures, causing legitimate outbound