ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This rule detects the presence of Agent Tesla, a remote access trojan that injects into processes to capture sensitive data such as credentials and keystrokes. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the exfiltration of critical business data before the adversary achieves their objectives.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`22ce7aa4be44869abd89ae411023739c`	payload	2026-09-05	95%
sha256_hash	`0e8021b43a43c8927aadebd29f5c04d0c6500d5f91f18f10e169695e7870c82c`	payload	2026-09-05	95%
sha1_hash	`43b89773b250ed4cb5a9a8b1fa56db88260ccbbd`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["22ce7aa4be44869abd89ae411023739c", "0e8021b43a43c8927aadebd29f5c04d0c6500d5f91f18f10e169695e7870c82c", "43b89773b250ed4cb5a9a8b1fa56db88260ccbbd"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Legitimate Application Updates via MSI/EXE Installers: Many enterprise applications (e.g., Adobe Creative Cloud, Zoom, or Java) use installer packages that may match known Agent Tesla IOCs if the vendor’s digital signature or specific file hash coincides with a known malicious variant, or if the installer uses generic names like setup.exe or install.msi in temporary directories.
- Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) and verify that the executable has a valid digital signature from a trusted vendor (e.g., Adobe, Zoom, Oracle).
Scheduled Backup or Sync Jobs: Tools like Veeam, Commvault, or OneDrive/SharePoint sync clients often run scheduled tasks that write temporary files or execute helper binaries in user profile temp folders (%TEMP% or %LOCALAPPDATA%\Temp). If these binaries are named generically (e.g., sync_helper.exe or backup_agent.exe) and reside in a path matching the IOC, they can trigger false positives.
- Filter/Exclusion: Exclude processes or files whose parent process is a known backup/sync service (e.g., VeeamBackup.exe, OneDrive.exe) and ensure the file path contains keywords like backup, sync, or temp combined with a trusted vendor name.
Development and Testing Environments: Developers often run local test instances of keylogging tools, RDP clients, or custom automation scripts (e.g., Python pyautogui wrappers or C# test harnesses) in development folders. These may use generic names or reside in non-standard directories that mimic Agent Tesla behavior.
- Filter/Exclusion: Exclude hosts tagged as dev, test, or qa in your CMDB