ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt targets the presence of Agent Tesla, a prevalent infostealer that exfiltrates credentials and sensitive data, by matching known IOCs to identify compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect and isolate active infections before they establish persistence or exfiltrate data, mitigating the high severity risk associated with this common ransomware precursor.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 10 IOC Types: domain, md5_hash, sha256_hash, sha1_hash

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.sequences.digital"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["1406c0b27cbb8d9b4d50e4eef4d5d1992a8fd566", "47f3ce7738a7a1e5bfdd668a3f4e4b77", "d5e8fa1f1a4b3e2aabb4f7b8e2c795b380703474be49e27928b69778153e274f", "e0faaa80311ada88e8d580e2f618d0efa00aa4ee", "5a71e6c07c13f03c7839b0631013d91f", "00279fe0b46466c6e23cf9c72ac09cf95e969ec8", "017d1815c562d887c711c3d5f9ca3cfa", "3ad1bdbba40ea98cc2a89e0e13ec9632cbbbc11306bc04e1203dee1513b95ce9", "c8ef459350bca905aa1576c61090ac8f30cdc675a14fb81e07913b072da6fb9a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

• Scenario: An IT administrator uses a standard deployment tool like SCCM (System Center Configuration Manager) or Intune to push a custom PowerShell script or batch file to endpoints for patching or configuration changes. If the script contains specific strings or executes commands matching the IOCs (e.g., specific registry keys or file paths), it may trigger the rule.

  • Filter/Exclusion: Exclude processes initiated by ccmexec.exe (SCCM) or MicrosoftEdge.exe/IntuneAgent.exe (Intune) when the parent process is a known management service. Alternatively, whitelist specific script paths under C:\Windows\CCM\ or C:\Program Files\Intune\.

• Scenario: A developer or QA engineer runs a local test harness or automated testing framework (e.g., Selenium, Appium, or a custom Python script) that interacts with the clipboard or simulates user input, potentially matching IOCs related to keylogging or clipboard monitoring behaviors.

  • Filter/Exclusion: Exclude processes where the parent process is python.exe, node.exe, or java.exe and the working directory is within a known development folder (e.g., C:\dev\, C:\projects\, or C:\Users\<user>\Documents\).

• Scenario: A legacy application or third-party utility (e.g., AutoHotkey, AutoIt, or a specific RPA tool like UiPath) is used for legitimate automation tasks that involve hooking into the Windows API for input simulation or clipboard access, which may overlap with Agent Tesla’s behavioral IOCs.

  • Filter/Exclusion: Whitelist known automation executables such as AutoHotkey.exe, AutoIt3.exe, or UiPath.exe when they are run from their standard installation directories (e.g