ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with the Unknown Stealer malware, a tool frequently used by adversaries to exfiltrate sensitive data such as credentials and browser history from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy infections that may have evaded traditional signature-based detections, enabling rapid containment before the threat actor achieves their objectives.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 3 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095`	payload	2026-09-12	100%
sha256_hash	`78cf8d71ec2451e820a7260f79e1bad47db041c004690668e11c05b1c7d764d3`	payload	2026-09-12	100%
sha256_hash	`65af8ffdecfc2394c2a27c6d53880ad5b89de8fd201a69d33a34e31e320a3a5d`	payload	2026-09-12	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown Stealer
let malicious_hashes = dynamic(["246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce095", "78cf8d71ec2451e820a7260f79e1bad47db041c004690668e11c05b1c7d764d3", "65af8ffdecfc2394c2a27c6d53880ad5b89de8fd201a69d33a34e31e320a3a5d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown Stealer

False Positive Guidance

Scenario: A DevOps engineer runs a custom Python script to audit and clean up stale temporary files in the C:\Users\Public\Temp directory, which contains a known hash associated with a legacy internal build artifact that matches a ThreatFox IOCs entry.
- Filter/Exclusion: Exclude alerts where the parent process is python.exe or pwsh.exe and the command line contains keywords like Get-ChildItem, Remove-Item, or Clean-Temp, specifically targeting paths under C:\Users\Public\Temp or C:\Windows\Temp.
Scenario: The enterprise endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled “Quarantine Review” job that touches a file previously flagged as suspicious but later whitelisted by the security team, triggering a re-scan that matches the IOCs hash.
- Filter/Exclusion: Exclude alerts where the source process is the EDR agent binary (e.g., falconctl.exe, MsMpEng.exe) and the action is “Scan” or “Verify” rather than “Execute” or “Write,” or exclude specific service accounts used for EDR maintenance tasks.
Scenario: A CI/CD pipeline (e.g., Jenkins or Azure DevOps) downloads a third-party open-source library (e.g., libpng or zlib) that has a known false-positive hash in ThreatFox due to a past minor vulnerability that was patched but not yet updated in the IOC feed.
- Filter/Exclusion: Exclude alerts for processes originating from the CI/CD service account (e.g., svc-ci-cd) or specific build agent hosts, and filter out file paths containing /node_modules/, /vendor/, or /lib/ if the file extension is a standard library format (`.