ThreatFox: stealler IOCs

Hunt Hypothesis

This hunt targets the presence of known Indicators of Compromise (IOCs) associated with the “stealler” malware family, which is designed to exfiltrate sensitive data such as credentials and browser information. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or cloud assets before the adversary can successfully extract and leverage stolen secrets for lateral movement or privilege escalation.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2b8ed70633be6e539cbdf7ac60b770aece2442c8`	payload	2026-09-06	95%
md5_hash	`1eeb3ebf665197ce9a35fc1ac745c118`	payload	2026-09-06	95%
sha256_hash	`edd33db4a56d62fc653f67fc589d3421a2ce6678b4a28f85077f9200d8f2ea8b`	payload	2026-09-06	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["2b8ed70633be6e539cbdf7ac60b770aece2442c8", "1eeb3ebf665197ce9a35fc1ac745c118", "edd33db4a56d62fc653f67fc589d3421a2ce6678b4a28f85077f9200d8f2ea8b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Legitimate Stealer Cleanup or Forensics: Security engineers or incident responders manually deploying known stealer binaries (e.g., Raccoon, Lumma, or RedLine samples) to isolated test VMs or endpoints for signature validation, memory analysis, or YARA rule testing.
- Filter/Exclusion: Exclude processes where the parent process is a known security tool (e.g., Sysinternals, Wireshark, Fiddler, or specific EDR console agents) or where the file path resides in a dedicated C:\Forensics\ or C:\Temp\IOC_Test\ directory.
Third-Party Remote Support or RMM Agents: Enterprise Remote Monitoring and Management (RMM) tools like ConnectWise Automate, NinjaOne, or Datto RMM may download and execute helper scripts or temporary executables that match generic stealer IOCs (such as specific hash values or file names like update.exe or helper.dll) during agent updates or task execution.
- Filter/Exclusion: Exclude detections where the parent process is a known RMM agent (e.g., nagios.exe, cwagent.exe, ninjaone.exe) or where the working directory is within the vendor’s standard installation path (e.g., C:\Program Files\ConnectWise\).
Scheduled Maintenance or Patching Jobs: Scheduled tasks (e.g., via schtasks or Task Scheduler) running patch management agents like WSUS, SCCM/MECM, or Ivanti may temporarily create or execute files with names or hashes that overlap with stealer IOCs during the download or staging phase of updates.
- Filter/Exclusion: Exclude events where the parent process is a known patching service (e.g.,