ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hunt targets the presence of eight known indicators of compromise associated with the Unknown Stealer, a tool frequently used by threat actors to exfiltrate sensitive data and credentials. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or cloud resources before the adversary achieves their objective of data theft or lateral movement.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 8 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown Stealer
let malicious_ips = dynamic(["45.138.16.54"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.138.16.54"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["api.vexxuhq.site"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Stealer
let malicious_urls = dynamic(["https://vexxuhq.site/paths", "https://api.vexxuhq.site/send-embed", "https://api.vexxuhq.site/send-embed-viewer", "https://api.vexxuhq.site/download/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

• Scenario: A DevOps team deploys a new version of a proprietary internal monitoring agent (e.g., internal-telemetry-v2.exe) that shares a similar hash or file path structure with one of the Unknown Stealer IOCs due to a shared build pipeline or naming convention.
  • Filter/Exclusion: Exclude alerts where the file path resides in a specific application directory (e.g., C:\Program Files\InternalTools\Telemetry\) AND the parent process is a known service host (e.g., svchost.exe or wsl.exe), provided the file is signed by the internal corporate CA.
• Scenario: An IT administrator performs a manual software deployment using a script that downloads a utility from a trusted internal repository, but the download location is a temporary folder (%TEMP% or C:\Users\Public\Downloads) which matches the “suspicious location” heuristic often paired with stealer IOCs.
  • Filter/Exclusion: Exclude if the parent process is a known deployment tool (e.g., powershell.exe running a script from C:\Scripts\Deploy\ or wsus.exe) AND the file is created within the last 5 minutes, correlating with a scheduled task or GPO push event.
• Scenario: A security engineer tests a new endpoint detection rule by copying a benign test file (e.g., test-stealer-mimic.dll) to a user’s desktop or downloads folder to verify alerting, inadvertently triggering the IOC match.
  • Filter/Exclusion: Exclude if the file name contains specific test identifiers (e.g., test_, mimic_, poc_) OR if the user account is part of the Security-Testing AD group, provided the file size matches the expected test artifact size.
• Scenario: