ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Stealer malware family, which is known for harvesting credentials and sensitive data from compromised endpoints. SOC teams should proactively hunt for these IOCs within Azure Sentinel to rapidly detect early-stage infections and prevent lateral movement before attackers can exfiltrate critical assets.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2794280875a99f47ddcf347f3eaa5f57ecc30058`	payload	2026-08-13	95%
md5_hash	`757b7e2991187e4644f8092801547730`	payload	2026-08-13	95%
sha256_hash	`664f8e49f45b3fda22f2deb4a164e9dd0737cd8ec65aef928526b86424bb3726`	payload	2026-08-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["2794280875a99f47ddcf347f3eaa5f57ecc30058", "757b7e2991187e4644f8092801547730", "664f8e49f45b3fda22f2deb4a164e9dd0737cd8ec65aef928526b86424bb3726"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: stealler IOCs detection rule in an enterprise environment:

Scenario: Enterprise Backup Solutions Scanning Stealer Artifacts
- Context: Major backup platforms like Veeam Backup & Replication or Rubrik often scan and index directories containing executable files (.exe, .dll) that match the file hashes associated with the Stealer family. When these tools perform incremental scans on user home directories, they may trigger the rule by accessing IOCs linked to legitimate software installers or updates that share hash similarities with known Stealer components.
- Suggested Filter/Exclusion: Create a filter to exclude processes spawned by VeeamAgent.exe, rubrik-agent.exe, and their child processes when they access files in standard backup staging folders (e.g., C:\ProgramData\Veeam\Backup or D:\RubrikStaging).
Scenario: Scheduled Endpoint Protection Scans
- Context: During nightly maintenance windows, endpoint protection suites such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black perform deep heuristic scans. These engines often load specific detection signatures that include the Stealer IOCs to verify their own integrity or scan against known threats. This activity can generate alerts when the security agent itself triggers a match on its own signature database files.
- Suggested Filter/Exclusion: Exclude events where the Process Name is FalconSensor.exe, MsMpEng.exe, or cbengine.exe and the Parent Process is the same, provided the event timestamp falls within the defined maintenance window (e.g., 02:00 – 04:00 UTC).
Scenario: Software Deployment via Configuration Management Tools
- Context: IT