ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the Unknown Stealer to exfiltrate sensitive credentials and data using newly identified Indicators of Compromise (IOCs). Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity stealer allows the SOC team to contain lateral movement and prevent widespread credential theft before automated alerts trigger.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["advanceslibrary.com", "remiumholdings.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Stealer IOCs rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Policy Updates via CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon Sensor performs a scheduled background update of its definition database. During this process, the sensor downloads and executes a temporary installer package that matches a generic hash or network signature associated with “Unknown Stealer” families in the ThreatFox feed, triggering an alert on all workstations simultaneously.
  • Filter/Exclusion: Create an exclusion based on the Process Name (FalconService.exe) and Parent Process (svchost.exe), specifically targeting the C:\Program Files\CrowdStrike\ directory path to bypass alerts from known EDR maintenance activities.

• Microsoft 365 Auto-Update for Office Suite

  • Scenario: The Microsoft Office Click-to-Run service initiates a major feature update or security patch deployment during business hours. This involves downloading large payloads and executing the OfficeC2RClient.exe process, which generates network traffic to Microsoft content delivery networks (CDNs) that overlap with known IOCs for stealer malware communication patterns.
  • Filter/Exclusion: Exclude alerts where the Destination IP belongs to Azure/Microsoft CDN ranges (e.g., 13.64.0.0/12) and the Process Name is OfficeC2RClient.exe or ClickToRun.exe, provided the process signature matches the official Microsoft certificate chain.

• Scheduled Enterprise Backup Jobs using Veeam Agent

  • Scenario: A nightly scheduled task runs the Veeam Agent for Windows to perform a full system backup. The agent creates temporary staging files and communicates with the central management server, generating file hashes