ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the “Unknown Stealer” malware family, which often operates through browser extensions or scripts to exfiltrate sensitive credentials and session tokens. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints or user sessions before the adversary can leverage stolen data to escalate privileges or persist within the environment.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 12 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["okekjaiw.click", "stv4ec5.shop", "vg5sgxv.lol", "8jdjpwka.baby", "apdhlhs3.xyz", "bduwih8.pro", "fbuytf67.click", "j9af4sr.guru", "machine628.baby", "67sixcebeh.surf", "quartzdraft.com", "kernel-87.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

• Scenario: A security team performs a manual threat hunt using YARA or Sigma rules to identify potential stealer malware (e.g., FormBook, Raccoon, or Lumma) on a specific endpoint. The detection logic likely matches against known hash values, file paths, or registry keys associated with these stealers.

  • Filter/Exclusion: Exclude alerts where the source process is a known security tool such as yara.exe, sigmacat, or osqueryd. Alternatively, create a dynamic exclusion for hosts tagged with ThreatHunt or IncidentResponse in your CMDB or asset management system during active hunts.

• Scenario: An IT administrator deploys a new version of a legitimate application that shares a similar file name, path structure, or hash with a known stealer IOC (e.g., a custom internal tool named stealer.exe or a third-party utility with a matching SHA256).

  • Filter/Exclusion: Maintain a whitelist of approved internal applications and third-party software hashes. If the detection rule is hash-based, add the specific SHA256 of the legitimate binary to the exclusion list. If it is path-based, exclude specific directories like C:\InternalTools\ or C:\Program Files\ApprovedApp\.

• Scenario: A scheduled maintenance job or backup process temporarily creates a file in a temporary directory (e.g., %TEMP% or C:\Users\Public\) that matches the file name or path pattern of a known stealer (e.g., config.dat or data.bin used by Raccoon Stealer).

  • Filter/Exclusion: Exclude alerts where the file is located in standard temporary or backup directories such as %TEMP%, C:\Windows\Temp, or C:\Backup\. Additionally, exclude