ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior where threat actors deploy Unknown Stealer malware to exfiltrate sensitive credentials and data by leveraging known indicators of compromise (IOCs). The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections and mitigate potential data breaches before lateral movement occurs.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 11 IOC Types: domain, ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown Stealer
let malicious_ips = dynamic(["136.244.100.54"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["136.244.100.54"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["allremdeskriki.com", "dubl1allremriki.com", "woolvilli.com", "dubl2allremriki.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Stealer
let malicious_urls = dynamic(["http://dubl2allremriki.com/api/v2", "http://allremdeskriki.com/api/v2", "http://dubl1allremriki.com/api/v2", "http://woolvilli.com/api/v2", "http://136.244.100.54/api/v1/agent/ws", "http://136.244.100.54/api/v1/agent/register"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown Stealer IOCs rule in an enterprise environment:

• Scenario: Scheduled Backup Jobs Executing via PowerShell

  • Context: Enterprise backup solutions (e.g., Veeam, Commvault) often utilize scheduled PowerShell scripts that download configuration manifests or check for updates from external repositories. These scripts may resolve to IP addresses or domains listed in the ThreatFox IOCs if they share infrastructure with known stealer campaigns.
  • Filter/Exclusion: Exclude processes where ProcessName matches powershell.exe AND CommandLine contains keywords like “Backup”, “Sync”, or specific internal backup tool signatures (e.g., -Veeam, -Commvault). Additionally, filter by excluding traffic originating from known Backup Server FQDNs.

• Scenario: Endpoint Protection Agent Updates

  • Context: Security agents such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently poll update servers to fetch definition databases and policy configurations. If the Unknown Stealer IOCs include common CDN endpoints (e.g., Azure Content Delivery Network) used by these vendors, legitimate agent heartbeat or update traffic will trigger alerts.
  • Filter/Exclusion: Create an exclusion for ProcessName matching specific security agents (FalconSensor.exe, MsMpEng.exe, SentinelOneAgent.exe) where the destination port is 443 and the source user context is a system account (e.g., NT AUTHORITY\SYSTEM).

• Scenario: Admin-Driven Software Deployment via SCCM/Intune

  • Context: System administrators often use Microsoft Endpoint Configuration Manager (SCCM) or Intune to push software updates. During the deployment phase, client machines establish connections to distribution points that may resolve to external IPs included in the stealer IOC list, particularly