ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with Agent Tesla malware by monitoring for specific indicators of compromise such as unique file hashes and network connections to known command-and-control infrastructure. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of this remote access trojan can prevent lateral movement and data exfiltration before the threat establishes persistence across the environment.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.altatsradgez.com", "ftp.piovau.com", "ftp.duct-master.com", "ftp.cantablew.top"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management Scans via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) performs scheduled hardware and software inventory scans on endpoints. During these scans, the ConfigMgr.exe agent may spawn child processes that interact with specific registry keys or network ports monitored by the Agent Tesla IOCs to verify device compliance. This legitimate background activity can mimic the initial handshake patterns of a remote access tool.
  • Filter/Exclusion: Create an exclusion for process paths containing \Microsoft\CCM\ and parent process names ccmexec.exe. Additionally, exclude network traffic originating from the SCCM site server IP range during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Endpoint Detection and Response (EDR) Self-Updates

  • Scenario: Enterprise EDR solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently update their sensor definitions. The updater service often establishes outbound connections to vendor cloud endpoints that share IP reputation lists with Agent Tesla’s command-and-control infrastructure. If the IOC list includes generic TLS certificates or shared ASN ranges, these routine updates will trigger alerts.
  • Filter/Exclusion: Exclude traffic where the destination domain matches known EDR update domains (e.g., *.falcon.crowdstrike.com or *.microsoft.com) and restrict alerting to the specific hash signatures of the EDR updater executable (FalconService.exe or MsMpEng.exe).

• Remote Desktop Administration via Citrix/VMware Horizon

  • Scenario: Help desk administrators utilize Citrix Workspace or VMware Horizon Client to troubleshoot user sessions. When an admin connects to a