This rule detects the presence of known indicators of compromise associated with the Unknown Stealer malware, which typically exfiltrates sensitive data such as browser credentials and cryptocurrency wallet information. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary achieves full data exfiltration or establishes persistence.
Malware Family: Unknown Stealer Total IOCs: 149 IOC Types: sha256_hash, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | c72c17b0abc3b8c184eafed3e983985016a4b201844425e7009eb00faf96cfbd | payload | 2026-09-17 | 100% |
| domain | yoga-fuer-maenner.de | payload_delivery | 2026-09-17 | 75% |
| domain | youhityourgoal.com | payload_delivery | 2026-09-17 | 75% |
| domain | zahnschirm.de | payload_delivery | 2026-09-17 | 75% |
| domain | zavimed.com | payload_delivery | 2026-09-17 | 75% |
| domain | zekerzit.nl | payload_delivery | 2026-09-17 | 75% |
| domain | zhang-ramen.de | payload_delivery | 2026-09-17 | 75% |
| domain | zwergennest-ulm.de | payload_delivery | 2026-09-17 | 75% |
| domain | vircaio.com | payload_delivery | 2026-09-17 | 75% |
| domain | visco-foam.com | payload_delivery | 2026-09-17 | 75% |
| domain | vivasicurezza.com | payload_delivery | 2026-09-17 | 75% |
| domain | vocalroads.com | payload_delivery | 2026-09-17 | 75% |
| domain | wagahattourist.com | payload_delivery | 2026-09-17 | 75% |
| domain | wahlplakate-archiv.de | payload_delivery | 2026-09-17 | 75% |
| domain | wakeeup.com | payload_delivery | 2026-09-17 | 75% |
| domain | wcpot.net | payload_delivery | 2026-09-17 | 75% |
| domain | willettebuilding.com | payload_delivery | 2026-09-17 | 75% |
| domain | xn--12ct4ap8bj4eva5b4gxe.com | payload_delivery | 2026-09-17 | 75% |
| domain | yeralogando.com | payload_delivery | 2026-09-17 | 75% |
| domain | yildirimotoaksesuar.com | payload_delivery | 2026-09-17 | 75% |
| domain | toorangostar.com | payload_delivery | 2026-09-17 | 75% |
| domain | topset-coaching.de | payload_delivery | 2026-09-17 | 75% |
| domain | tourbigeasy.com | payload_delivery | 2026-09-17 | 75% |
| domain | underthebooth.com | payload_delivery | 2026-09-17 | 75% |
| domain | undoism.org | payload_delivery | 2026-09-17 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["yoga-fuer-maenner.de", "youhityourgoal.com", "zahnschirm.de", "zavimed.com", "zekerzit.nl", "zhang-ramen.de", "zwergennest-ulm.de", "vircaio.com", "visco-foam.com", "vivasicurezza.com", "vocalroads.com", "wagahattourist.com", "wahlplakate-archiv.de", "wakeeup.com", "wcpot.net", "willettebuilding.com", "xn--12ct4ap8bj4eva5b4gxe.com", "yeralogando.com", "yildirimotoaksesuar.com", "toorangostar.com", "topset-coaching.de", "tourbigeasy.com", "underthebooth.com", "undoism.org", "unser-dorf-lietzow.de", "upsolutservice.de", "uptime.com.br", "urlaubsdomizil-binz.de", "veprivletech.cz", "verifiedstats.net", "startupcv.ca", "szendryk-partner.de", "tadi.travel", "talentclinics.com", "tastyroots.blog", "tc-donauwoerth.de", "thanhtungtrieudo.com", "thegrimeguys.com", "thehappycoders.com", "theluxurycruiseadvisors.com", "themilkminimalist.com", "theplumberinc.com", "savingdogsandcats.com", "schmidt-russnak.de", "seiden-collagen-faden-lifting.com", "selftalkinstitute.com", "shopichain.com", "simenyi.hu", "skraddarnshus.se", "smartmedservices.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Stealer
let malicious_hashes = dynamic(["c72c17b0abc3b8c184eafed3e983985016a4b201844425e7009eb00faf96cfbd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
cron job using rsync or robocopy to synchronize application logs or backup files from a staging server to a central archive. The source path contains a directory named stealer (e.g., /var/log/app/stealer/) or the destination includes a folder like C:\Backups\Stealer\, causing the file path or command line to match the IOC string.
rsync.exe, robocopy.exe, scp.exe) AND the user account belongs to a service account or a specific “DevOps” security group.C:\Tools\Yara\unknown_stealer.yar), which gets logged in the command line or file creation events.
powershell.exe, python.exe, yara.exe) AND the working directory or parent path is within a designated tooling folder (e.g., C:\Tools\, C:\Security\, C:\Scripts\).Stealer (or similar, like MyStealer) on a file server or workstation to temporarily store files before moving them to their final location. The act of creating the directory or accessing files within it triggers the path-based IOC.