ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the Unknown Stealer, a tool frequently used by adversaries to exfiltrate sensitive data such as credentials and browser history. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints or cloud resources before the attacker can establish persistence or escalate privileges, thereby reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["okekjaiw.click", "stv4ec5.shop", "vg5sgxv.lol", "8jdjpwka.baby", "apdhlhs3.xyz", "bduwih8.pro", "fbuytf67.click", "j9af4sr.guru", "machine628.baby", "67sixcebeh.surf", "quartzdraft.com", "kernel-87.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

• Scenario: A security operations team or incident response engineer manually deploys a forensic collection script (e.g., using Sysmon or Velociraptor) that queries specific registry keys or file paths associated with the “Unknown Stealer” IOCs to verify the presence of artifacts on a suspected host.

  • Filter/Exclusion: Exclude events where the parent process is a known forensic or EDR agent (e.g., velociraptor.exe, sysmon.exe, edr_agent.exe) and the command line contains keywords like query, collect, or hunt.

• Scenario: An application deployment pipeline or CI/CD system (e.g., Jenkins, GitHub Actions, or Azure DevOps) installs a third-party dependency or library that includes a binary or configuration file matching one of the 12 IOCs (e.g., a specific DLL hash or registry path) as part of a standard build or update process.

  • Filter/Exclusion: Exclude events where the parent process is a build tool or package manager (e.g., msbuild.exe, npm.exe, pip.exe, dotnet.exe) and the event occurs within a designated build agent service account or directory path (e.g., C:\builds\, /home/ci/).

• Scenario: A legacy enterprise application or custom internal tool uses a specific registry key or file path (one of the IOCs) for its own configuration storage or state management, which coincidentally matches an IOC associated with the stealer.

  • Filter/Exclusion: Exclude events where the accessing process is a known internal application binary (e.g., intranet_app.exe, legacy_tool.dll) and the target path is within the application’s designated installation or data directory (e.g., C:\Program Files\InternalApp\, `C:\Users\Public\