ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt targets adversaries leveraging Agent Tesla keyloggers delivered through phishing campaigns to silently capture credentials and keystrokes before exfiltrating them to external C2 infrastructure. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat prevents the compromise of sensitive user data that often goes unnoticed until after significant lateral movement or data loss occurs.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.conceptpavagebtp.eu", "ftp.fibrasanchez.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• IT Asset Management Scans via Microsoft SCCM/Intune

  • Scenario: The IT operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy a standardized software inventory agent. This agent periodically scans endpoints for installed applications and browser versions, generating network traffic to internal management servers that mimics the C2 beaconing behavior of Agent Tesla. If these internal IPs share characteristics with known Tesla infrastructure ranges, they may trigger the rule.
  • Filter/Exclusion: Create an exclusion based on the Source IP (internal SCCM/Intune server subnets) or filter out traffic destined for specific Internal FQDNs used by the asset management platform. Additionally, exclude processes with a known Publisher of “Microsoft Corporation” and Path matching the standard deployment directory (e.g., C:\Program Files\Microsoft Intune Agent).

• Automated Browser Health Checks via Chrome Enterprise Policy

  • Scenario: The enterprise enforces Google Chrome policies that automatically check for updates, sync user preferences, and validate security certificates. These scheduled tasks (GoogleUpdate.exe or chrome.exe) initiate outbound connections to Google’s update servers and telemetry endpoints. Since Agent Tesla heavily targets browser data exfiltration, the volume of keystroke-related metadata sent by Chrome’s built-in diagnostic tools can resemble Tesla’s exfiltration patterns.
  • Filter/Exclusion: Exclude traffic originating from the specific process chrome.exe or GoogleUpdate.exe when communicating with known Google Cloud IP ranges (e.g., 142.250.x.x). A more granular filter could exclude events where the User Agent string contains “Chrome-Enterprise” and the