ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt targets the presence of Agent Tesla, a remote access trojan frequently used by adversaries to steal credentials and establish persistent access, by correlating its known indicators of compromise against telemetry in Azure Sentinel. Proactively hunting for these IOCs is critical because Agent Tesla often operates stealthily to exfiltrate sensitive data, making early detection essential to disrupt the attacker’s post-exploitation activities before they escalate privileges or move laterally.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`fd5ace68d49a2d5d5663c1c6b134705b`	payload	2026-09-12	95%
sha256_hash	`fab988a0b181785fd70536a3557f3e2d8474fe1f4cdbc2c6138078da5f691f26`	payload	2026-09-12	95%
sha1_hash	`1e1e0c41adfc16eca44a98cef207373e0a86ac5a`	payload	2026-09-12	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["fd5ace68d49a2d5d5663c1c6b134705b", "fab988a0b181785fd70536a3557f3e2d8474fe1f4cdbc2c6138078da5f691f26", "1e1e0c41adfc16eca44a98cef207373e0a86ac5a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Scenario: A DevOps team deploys a custom internal monitoring agent or RMM (Remote Monitoring and Management) tool that uses a generic or obfuscated binary name matching one of the Agent Tesla IOCs (e.g., svchost.exe or update.exe in a non-standard path).
- Filter/Exclusion: Exclude alerts where the process path is under a known application directory (e.g., C:\Program Files\InternalTools\ or C:\Program Files (x86)\RMM\) and the parent process is a known service manager (e.g., services.exe or svchost.exe with a specific PID range).
Scenario: An IT administrator manually runs a legacy backup utility or a specific vendor’s update tool from a network share or USB drive, which has a filename matching an IOC (e.g., backup_agent.exe or patch_installer.exe).
- Filter/Exclusion: Exclude alerts where the process is launched by a known administrative user account (e.g., DOMAIN\svc_backup or DOMAIN\it_admins) and the image path originates from a trusted network share (e.g., \\fileserver\apps\) or a specific USB drive letter (e.g., E:\).
Scenario: A scheduled task for a third-party application (e.g., Adobe Creative Cloud, Java, or a specific CRM client) executes a helper binary with a name matching an IOC (e.g., helper.exe or updater.exe) from a standard installation directory.
- Filter/Exclusion: Exclude alerts where the process path matches a known third-party installation directory (e.g., C:\Program Files\Adobe\ or C:\Program Files (x86)\Java\) and the parent process is Task Scheduler (`taskschd.msi