ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving Stealer malware by monitoring for specific indicators of compromise (IOCs) that signal potential credential theft and data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can leverage stolen credentials to access sensitive cloud resources.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`b07426979d61bbc20b209b88d2f6dd3f5cceb1ee`	payload	2026-08-28	95%
md5_hash	`57629b1f3807d324e3c51a340228fe5a`	payload	2026-08-28	95%
sha256_hash	`f19ce246b09aec504d8cb547f9d3344e14a6ca898f8d88f2207ece0d74f0d3f1`	payload	2026-08-28	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["b07426979d61bbc20b209b88d2f6dd3f5cceb1ee", "57629b1f3807d324e3c51a340228fe5a", "f19ce246b09aec504d8cb547f9d3344e14a6ca898f8d88f2207ece0d74f0d3f1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: stealler IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

Endpoint Security Agent Updates & Definitions Sync
- Scenario: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently download definition updates or perform scheduled health checks that match Stealer IOCs. These agents often connect to known update servers or hash signatures that overlap with the threat’s infrastructure.
- Filter/Exclusion: Exclude network traffic and process executions originating from specific EDR service accounts (e.g., SYSTEM, LocalSystem) running on the host where the agent is installed, specifically filtering for processes named FalconService.exe or MsMpEng.exe.
Scheduled Cloud Backup & Synchronization Jobs
- Scenario: Automated backup tools like Veeam Backup & Replication or OneDrive/SharePoint sync clients often initiate large data transfers to cloud storage endpoints. The IOCs associated with Stealer may include generic cloud storage domains or IP ranges that coincide with these legitimate backup destinations, triggering alerts during peak synchronization windows.
- Filter/Exclusion: Create an exclusion based on process names such as VeeamAgent.exe, OneDrive.exe, or SharePointSync.exe running under user accounts designated for data management (e.g., DOMAIN\BackupService). Additionally, exclude traffic to known corporate backup IP ranges during the defined maintenance window (e.g., 02:00–04:00 UTC).
IT Administration & Patch Management Deployments
- Scenario: During scheduled patch cycles using tools like SCCM (Microsoft Endpoint Configuration Manager) or Ivanti, administrators push updates that involve downloading payloads from Microsoft Update servers or third-party repositories. These downloads often utilize network paths and file hashes that intersect