ThreatFox: Arkei Stealer IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Arkei Stealer by identifying three specific Indicators of Compromise (IOCs) that signal potential credential theft and data exfiltration efforts within the network. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this stealer allows the SOC team to isolate compromised endpoints before sensitive credentials are harvested, thereby preventing lateral movement and broader organizational impact.

IOC Summary

Malware Family: Arkei Stealer Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1158797c8d9ef2696029b1d82e8a9515`	payload	2026-08-22	95%
sha256_hash	`e3ecc6938dd5234a75a8fda454717bba20897d6aa12b9a324b5f81305d1f7d66`	payload	2026-08-22	95%
sha1_hash	`31435c6f16df4fa56f251f1e45c495ae5b0c1562`	payload	2026-08-22	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Arkei Stealer
let malicious_hashes = dynamic(["1158797c8d9ef2696029b1d82e8a9515", "e3ecc6938dd5234a75a8fda454717bba20897d6aa12b9a324b5f81305d1f7d66", "31435c6f16df4fa56f251f1e45c495ae5b0c1562"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Arkei Stealer

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Arkei Stealer IOCs detection rule in an enterprise environment:

Scenario: Enterprise Backup Agent Execution
- Context: The Arkei Stealer often mimics legitimate backup processes. In many environments, tools like Veeam Backup & Replication, Rubrik, or Acronis Cyber Protect run scheduled jobs that generate network traffic and file hashes matching the Arkei IOCs (specifically regarding certificate validation or specific DLL loading patterns).
- Filter/Exclusion: Exclude processes where ProcessName matches known backup agents (e.g., VeeamBackupService.exe, rubrik-agent.exe) AND the ParentImage is located within the standard installation directory of the backup vendor. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Scheduled Antivirus or EDR Scans
- Context: Security suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently perform scheduled deep scans that load specific modules or network probes. These modules may trigger the same IOCs (such as specific registry key modifications or outbound connections to known update servers) that Arkei utilizes, leading to a collision in detection logic.
- Filter/Exclusion: Create an exclusion rule based on ProcessCommandLine containing keywords like “scheduled scan,” “update check,” or the specific vendor’s service name (e.g., csagent.exe, S1Service.exe). Ensure the filter applies only when the user context is a system account (e.g., NT AUTHORITY\SYSTEM) rather than an interactive user session.
Scenario: DevOps CI/CD Pipeline Artifacts *