ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This hunt identifies the presence of known indicators of compromise associated with the ACR Stealer, a tool frequently used by adversaries to exfiltrate sensitive data from Azure Container Registry. Proactively hunting for these IOCs allows the SOC to detect early-stage reconnaissance or data theft attempts before they escalate into a full breach within the Azure Sentinel environment.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ACR Stealer
let malicious_hashes = dynamic(["91410536fbaa9a8d9e9e13f3019e70ce93cae0f13ed8ef68f4234fa7a2b09f56", "605b5222a62efa748a131d4e0d852b479ee8d25a", "58eadcc3e89bed96bdc171d7ce9d36df"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses docker-compose or kubectl to pull and run a container image tagged with a known ACR Stealer hash (e.g., sha256:abc123...) for a temporary debugging session or local development environment.
  • Filter/Exclusion: Exclude alerts where the source process is docker.exe, podman.exe, or kubectl.exe, and the destination path resides within standard container storage directories (e.g., C:\ProgramData\Docker\, /var/lib/docker/, or C:\Users\<user>\.kube\).
• Scenario: An IT administrator runs a legacy backup utility (e.g., VeeamAgent.exe or AcronisBackup.exe) that temporarily downloads a known ACR Stealer IOC file to a staging folder (C:\Temp\BackupStaging\) before compressing it, triggering a hash-based match.
  • Filter/Exclusion: Exclude alerts where the file path matches C:\Temp\BackupStaging\ or similar staging directories, and the parent process is a known backup agent (VeeamAgent.exe, AcronisBackup.exe, CommCellAgent.exe).
• Scenario: A security team deploys a canary token or honeypot file with a known ACR Stealer IOC hash to a shared network drive (\\fileserver\security\canaries\) to test endpoint detection coverage.
  • Filter/Exclusion: Exclude alerts where the file path contains \security\canaries\ or \honeypots\, and the source IP is from the security team’s VLAN (e.g., 10.20.50.0/24).
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab Runner) downloads a build artifact or