ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection rule identifies the presence of known Agent Tesla indicators of compromise (IOCs) to uncover active reconnaissance or data exfiltration campaigns targeting Azure Sentinel environments. Proactive hunting for these specific signatures is critical because Agent Tesla’s sophisticated keylogging and remote access capabilities can silently compromise sensitive credentials before traditional alerts trigger, necessitating early intervention to prevent lateral movement.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 2 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["narang.cfd"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Agent Tesla
let malicious_urls = dynamic(["https://api.telegram.org/bot8758444991:AAFF69OIaaE8t3nxSJfNYHB1J5BXA71IuyI/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment:

• Scenario 1: Endpoint Protection Scanning Artifacts

  • Context: Enterprise antivirus solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often download definition updates or behavioral analysis signatures that contain file hashes matching known Agent Tesla components. This frequently occurs during the nightly update cycle where the AV engine extracts and scans a new signature database.
  • Filter/Exclusion: Exclude processes spawned by the primary EDR service (e.g., C:\Program Files\CrowdStrike\fs_qscan.exe or C:\Windows\System32\mpcmdrun.exe) when they initiate file downloads or extraction tasks in the Temp directory.

• Scenario 2: Scheduled Backup and Imaging Jobs

  • Context: Automated backup agents (e.g., Veeam Agent, Acronis Cyber Protect) running on a scheduled basis often create temporary staging files or image snapshots that match IOCs associated with Ransomware/InfoStealer families. These jobs frequently run during off-hours (e.g., 02:00 – 04:00) and involve high I/O operations in the C:\Backup or D:\Staging directories.
  • Filter/Exclusion: Create a whitelist for the backup service executable names (e.g., Veeam.Backup.Service.exe) and restrict the rule trigger to exclude file paths containing \Backup\, \Temp\, or specific staging folders used by the imaging software.

• Scenario 3: IT Admin Deployment via Configuration Management

  • Context: System administrators using tools like Microsoft SCCM (Configuration Manager) or Ansible often deploy security agents, patch management tools, or custom monitoring scripts that utilize libraries similar to Agent