ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Stealer malware family, which is known for harvesting sensitive credentials and personal data from compromised endpoints. A proactive hunt in Azure Sentinel is critical because early identification of these IOCs allows the SOC team to rapidly isolate affected systems and mitigate potential data exfiltration before lateral movement occurs.

IOC Summary

Malware Family: stealler Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`40ee71fb1e584d320db1dcbc71e8b00a2b1b0cac`	payload	2026-08-15	95%
md5_hash	`84412c10b460870f3f9a5db8df5c4fb1`	payload	2026-08-15	95%
sha256_hash	`d4aaf92e411b242f454647d7a6d1b3657a4699e419b273e7e4b63ce4d2cccb3c`	payload	2026-08-15	95%
sha1_hash	`97ec6c8b562aaef59b10812d6deb527b898767d7`	payload	2026-08-15	95%
md5_hash	`c1165519430c253c6f0a78c2e1c9b4d3`	payload	2026-08-15	95%
sha256_hash	`6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["40ee71fb1e584d320db1dcbc71e8b00a2b1b0cac", "84412c10b460870f3f9a5db8df5c4fb1", "d4aaf92e411b242f454647d7a6d1b3657a4699e419b273e7e4b63ce4d2cccb3c", "97ec6c8b562aaef59b10812d6deb527b898767d7", "c1165519430c253c6f0a78c2e1c9b4d3", "6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: stealler IOCs detection rule in an enterprise environment:

Scenario: Endpoint Protection Policy Updates via Scheduled Tasks
- Context: Enterprise-wide deployment of security patches often triggers background processes that match Stealer network signatures. For instance, a scheduled job running Microsoft Defender Antivirus or CrowdStrike Falcon updates may initiate outbound connections to update servers using ports and user agents similar to the detected IOCs.
- Filter/Exclusion: Exclude alerts where the process name matches known security vendors (e.g., MsMpEng.exe, FalconSensorService.exe) AND the parent process is a system scheduler (TaskScheduler or svchost.exe). Additionally, filter out traffic originating from internal IP ranges dedicated to patch management servers.
Scenario: Enterprise Backup and Data Archiving Operations
- Context: Automated backup solutions frequently scan local user profiles (Documents, Desktop) which are primary targets for Stealer malware. Tools like Veeam, Rubrik, or Commvault generate network traffic patterns that mimic data exfiltration behaviors associated with the Stealer rule.
- Filter/Exclusion: Create an exclusion list for processes belonging to known backup suites (e.g., vbr.exe, rubrik-agent.exe). If the detection logic relies on file access, add a condition to ignore events where the parent process is running under a dedicated service account (e.g., DOMAIN\BackupService) rather than an interactive user session.
Scenario: Cloud Storage Synchronization and OneDrive/SharePoint Activity
- Context: Users syncing large volumes of files via Microsoft OneDrive for Business or SharePoint often trigger network connections that resemble the IOCs associated with Stealer’s data theft mechanisms. The synchronization client (OneDrive.exe) frequently