ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This hypothesis targets the presence of ACR Stealer malware, a credential-stealing threat that actively harvests Azure Container Registry tokens to enable unauthorized access to container images and deployment pipelines. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised workloads before attackers leverage stolen credentials to push malicious images or exfiltrate sensitive data from the registry.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["canyonmere.cc", "sync.canyonmere.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses kubectl or a CI/CD pipeline (e.g., GitHub Actions, Jenkins) to pull container images from Azure Container Registry (ACR) for deployment. The detection logic may flag the specific API endpoints or registry hostnames as IOCs if the rule relies on generic ACR domain patterns or specific image digests associated with known ACR Stealer campaigns.

  • Filter/Exclusion: Exclude traffic or process executions originating from known CI/CD service IPs (e.g., 140.75.11.0/24 for GitHub Actions) or specific service accounts (e.g., azurerm-kubernetes-service-...). Additionally, whitelist the specific ACR registry domain (e.g., myregistry.azurecr.io) if the IOC is a generic hostname, ensuring only the specific malicious subdomains or paths are alerted.

• Scenario: An automated backup solution (e.g., Veeam, Commvault, or Azure Backup) performs a scheduled job that interacts with ACR to snapshot or verify container image integrity. The malware’s IOCs might include specific HTTP headers, user-agent strings, or API call sequences that mimic legitimate backup verification processes.

  • Filter/Exclusion: Create an exclusion for processes running under the backup service account (e.g., VeeamBackupSvc or CommvaultService) and for scheduled tasks named *Backup* or *ACRVerify*. Ensure the exclusion applies to the specific API endpoints (e.g., /v2/_catalog) used for listing images, which are common in both backup and stealer activities.

• Scenario: A security team runs a YARA scan or memory dump analysis tool (e.g., Volatility, Sysinternals) that loads ACR-related libraries or connects to the registry to validate image signatures. The ACR Stealer IOCs