ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection rule identifies active Agent Tesla infections characterized by the exfiltration of sensitive credentials, keystrokes, and browser data through its keylogging capabilities. SOC teams should proactively hunt for these indicators in Azure Sentinel to rapidly contain potential identity theft incidents before adversaries can leverage stolen authentication data for lateral movement or privilege escalation.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`84798b7f2d9b0a4eaac38348497fb4a63a811df9`	payload	2026-08-25	95%
md5_hash	`862b5f62028a30d7f6c8ef20d4450f29`	payload	2026-08-25	95%
sha256_hash	`3ab6ed7b7cb21244b34addf64ac6f64b1c38ee98236985511c4af47e8cc93cd4`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["84798b7f2d9b0a4eaac38348497fb4a63a811df9", "862b5f62028a30d7f6c8ef20d4450f29", "3ab6ed7b7cb21244b34addf64ac6f64b1c38ee98236985511c4af47e8cc93cd4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule, including context and recommended filters:

Endpoint Protection Scanning of Quarantined Archives
- Scenario: The enterprise Endpoint Detection and Response (EDR) solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan on the C:\Quarantine folder. This process extracts a previously detected Agent Tesla sample from a .zip archive containing historical threat intelligence feeds, triggering the IOC match against the extracted file hash even though it is not an active infection.
- Filter/Exclusion: Exclude processes spawned by the EDR service (e.g., C:\Program Files\CrowdStrike\fs_qc.exe) when scanning files within the C:\Quarantine or C:\Temp\ThreatIntel directories.
Security Operations Center (SOC) Threat Hunting Queries
- Scenario: A SOC analyst runs a manual threat hunting query using a tool like Splunk or Elastic Security to search for historical Agent Tesla indicators. The query executes a script that downloads and unpacks the latest Agent Tesla IOC package from a central repository, causing the detection engine to flag the unpacked files as new potential threats during the analysis window.
- Filter/Exclusion: Create an exclusion rule for processes running under the SYSTEM or specific service accounts (e.g., DOMAIN\sochunter_svc) that are executing within known “Threat Intel” network shares (e.g., \\fileserver\threat-intel\).
Automated Software Deployment and Patching
- Scenario: The IT Operations team utilizes a deployment tool like SCCM or Ivanti to push a security update package. This package includes a “clean-up utility” that temporarily extracts Agent Tesla signature definitions into the user