ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hypothesis targets the presence of Agent Tesla, a keylogger that injects into processes to steal credentials and keystrokes, often introduced via phishing campaigns. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the exfiltration of sensitive data to command-and-control servers before an adversary achieves full persistence.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`e2b4438f72c986add83c9d96d5aa46f7`	payload	2026-09-04	95%
sha256_hash	`252f94e8ae17237b19cb38dd3b82e8c09f53c33a323d4a6a6ddd202dd4b59435`	payload	2026-09-04	95%
sha1_hash	`463b0ea39778cad205d21bb657b044dcd889f289`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["e2b4438f72c986add83c9d96d5aa46f7", "252f94e8ae17237b19cb38dd3b82e8c09f53c33a323d4a6a6ddd202dd4b59435", "463b0ea39778cad205d21bb657b044dcd889f289"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) running on a Windows host uses the java.exe process to establish outbound HTTPS connections to a third-party SaaS API for data synchronization. If the specific IP address or domain hash matches a known Agent Tesla C2 indicator, the rule may trigger because Agent Tesla often abuses standard Java or .NET runtimes for exfiltration.
- Filter/Exclusion: Exclude alerts where the parent process is java.exe or dotnet.exe and the destination port is 443, provided the destination domain is whitelisted in the corporate SaaS inventory (e.g., *.aws.com, *.azure.com).
Scenario: An enterprise endpoint protection agent (such as CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a scheduled integrity scan or policy update, creating a new temporary executable or modifying memory sections of a benign service process (like svchost.exe or lsass.exe) to verify configuration hashes. This can mimic the code injection or memory manipulation behavior associated with Agent Tesla.
- Filter/Exclusion: Exclude alerts where the initiating process is a known EDR agent binary (e.g., FalconSensor.exe, cb.exe, SentinelOneAgent.exe) and the action is a “policy update” or “integrity check” rather than a network exfiltration event.
Scenario: A development team uses a local web server (e.g., IIS Express or Node.js) on a developer workstation to test a new internal dashboard. The application makes outbound HTTP requests to a staging environment IP address that has been recently added to the ThreatFox IOC list due to a shared infrastructure overlap with a known botnet.
- Filter/Exclusion: Exclude alerts for processes named node.exe, iisexpress.exe, or `