ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hunt targets the presence of nine known indicators of compromise associated with the Unknown Stealer, a tool frequently used by threat actors to exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify active infections or recent compromises before the adversary achieves their objective of data theft or lateral movement.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 9 IOC Types: ip:port, domain, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown Stealer
let malicious_ips = dynamic(["146.19.191.11"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["146.19.191.11"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["ays.gamepazarin.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Stealer
let malicious_urls = dynamic(["http://146.19.191.11/s", "http://146.19.191.11/t", "http://146.19.191.11/l", "http://146.19.191.11/api/injection", "https://ays.gamepazarin.com/s", "https://ays.gamepazarin.com/e", "https://ays.gamepazarin.com/l"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

• Scenario: Automated Patch Management via SCCM/WSUS

  • Description: System Center Configuration Manager (SCCM) or WSUS agents frequently download and execute update packages from specific internal endpoints or known Microsoft CDN IPs. If the “Unknown Stealer” IOCs include generic IP ranges or hash values that overlap with common Windows Update infrastructure or internal distribution points, legitimate patch deployment cycles will trigger alerts.
  • Filter/Exclusion: Exclude alerts where the source IP is within the internal RFC1918 range (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or where the process name is ccmexec.exe, wuauclt.exe, or svchost.exe associated with the Windows Update service.

• Scenario: Enterprise Backup Agents (Veeam/Commvault)

  • Description: Backup software like Veeam Backup & Replication or Commvault Simpana often communicates with backup repositories over specific ports or IP addresses. If the IOCs include network connections to common backup server IPs or specific TCP ports (e.g., 9401 for Veeam), the detection may flag these routine data transfer sessions as suspicious, especially if the IOCs are based on connection metadata rather than unique process hashes.
  • Filter/Exclusion: Exclude alerts where the destination port matches known backup service ports (e.g., 9401, 8443) or where the process name is vbr.exe (Veeam Backup & Replication service) or cvpp.exe (Commvault Provider Process).

• Scenario: Third-Party Endpoint Protection/EDR Agents

  • Description: EDR solutions like Crowd