ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hypothesis targets the presence of Agent Tesla, a keylogging malware that exfiltrates sensitive credentials and financial data through encrypted channels, often introduced via phishing or exploit kits. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints and detect unauthorized data exfiltration before attackers establish persistent access or steal high-value assets.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`ff7fe11166b27eb6f3e0c8cb02a50f8c`	payload	2026-09-11	95%
sha256_hash	`0298b368f84837c39e3361517e0efc6ff0e1e25e17cdd34cfd297f15f4a149ff`	payload	2026-09-11	95%
sha1_hash	`fcbbe468195ec9f863edb4f6b6528bbe6f9dcc0c`	payload	2026-09-11	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["ff7fe11166b27eb6f3e0c8cb02a50f8c", "0298b368f84837c39e3361517e0efc6ff0e1e25e17cdd34cfd297f15f4a149ff", "fcbbe468195ec9f863edb4f6b6528bbe6f9dcc0c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Legitimate Remote Support Sessions: IT support teams using remote control software like TeamViewer or AnyDesk often generate high-volume encrypted outbound traffic to relay screen shares and keystrokes, which can mimic the exfiltration patterns of Agent Tesla.
- Filter/Exclusion: Exclude outbound traffic from known remote support application binaries (e.g., TeamViewer.exe, AnyDesk.exe) or specific source ports associated with these tools, provided the session is initiated by a verified admin account.
Scheduled Backup and Sync Operations: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik perform large, encrypted data transfers to off-site storage or cloud destinations on scheduled intervals, potentially triggering alerts for unusual outbound volume.
- Filter/Exclusion: Correlate alerts with the system’s scheduled task manager or backup agent logs to confirm the traffic aligns with known backup windows; exclude traffic from backup service accounts or specific backup agent executables (e.g., VeeamBackup.exe).
Software Update and Patch Management: Patch management tools like WSUS (Windows Server Update Services) or Ivanti push updates to endpoints, resulting in significant outbound connections to vendor update servers or internal distribution points that may appear as anomalous encrypted traffic.
- Filter/Exclusion: Whitelist known vendor update server IP ranges or domain names (e.g., *.windowsupdate.com, internal patch server FQDNs) and exclude traffic from update service processes (e.g., wuauclt.exe, IvantiAgent.exe).
Collaboration and File Sharing Services: End users frequently use Microsoft Teams or SharePoint to upload large files or conduct video conferences, generating sustained encrypted outbound traffic that can resemble malware exfiltration, especially if the user is in a non-standard department or location.