ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This hypothesis targets the execution or network activity associated with the ACR Stealer malware, a credential-stealing tool that often leverages Azure Container Registry (ACR) infrastructure to exfiltrate secrets or establish persistence. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised container workloads or registry access that could lead to unauthorized lateral movement and data exfiltration within the cloud environment.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["logs.primebyte.cc", "mail.novaform.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

• Automated Credential Rotation via Ansible or Terraform: DevOps teams often use configuration management tools like Ansible or Terraform to automate the rotation of Azure Container Registry (ACR) access keys or service principal secrets. These tools may execute docker login or az acr login commands in batch scripts or scheduled jobs, potentially generating network connections or process creations that match the IOCs (e.g., specific user-agent strings or port 443 connections to ACR endpoints) if the rule is overly broad on network traffic.

  • Filter/Exclusion: Exclude processes initiated by known automation binaries (e.g., ansible-playbook.exe, terraform.exe, or python.exe running specific modules) and filter network events where the source process is part of the CI/CD pipeline service account or specific DevOps server IPs.

• CI/CD Pipeline Image Pushes (Jenkins/GitLab CI): Continuous Integration/Continuous Deployment pipelines frequently push container images to ACR as part of build verification. Agents running on build servers (e.g., Jenkins agents, GitLab runners) will consistently perform docker push operations, creating predictable network flows and process executions that can trigger IOCs related to ACR communication or specific credential storage paths.

  • Filter/Exclusion: Exclude network connections from known CI/CD agent hostnames or IP ranges (e.g., jenkins-agent-01, gitlab-runner-*) and filter process creation events where the parent process is a recognized CI/CD runner binary (e.g., docker.exe, kubectl.exe, or sh.exe executing pipeline scripts).

• Scheduled Backup Jobs Using Veeam or Commvault: Enterprise backup solutions often include container registry snapshots or image backups. These scheduled jobs may use CLI tools or APIs to interact with ACR for metadata retrieval or image export, potentially triggering IOCs if the rule monitors for