ThreatFox: Epsilon Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the Epsilon Stealer malware by monitoring for specific Indicators of Compromise (IOCs) that signal active credential and data theft within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain early-stage infestations, preventing potential lateral movement and sensitive information exfiltration before they escalate into major incidents.

IOC Summary

Malware Family: Epsilon Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`1607b565ada67a4c0dc8eda7dc35e70582a362b7`	payload	2026-08-15	95%
md5_hash	`6fbacb02382b2a52786994adeed3c8b1`	payload	2026-08-15	95%
sha256_hash	`8502dd5e803f7583007481e1821f9242a6ba2774974f6757dd0535a688f6e1b1`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Epsilon Stealer
let malicious_hashes = dynamic(["1607b565ada67a4c0dc8eda7dc35e70582a362b7", "6fbacb02382b2a52786994adeed3c8b1", "8502dd5e803f7583007481e1821f9242a6ba2774974f6757dd0535a688f6e1b1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Epsilon Stealer

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: Epsilon Stealer IOCs detection rule:

Scenario: Automated Endpoint Protection Scans
- Context: Enterprise security suites like CrowdStrike Falcon or Microsoft Defender for Endpoint frequently perform scheduled daily scans that query known threat intelligence feeds. During these scans, the agent may download and process Epsilon Stealer IOCs (hashes, URLs) from a central management server to update local detection policies, triggering the rule without actual malware presence.
- Filter/Exclusion: Exclude network traffic and file hash matches originating from the specific IP ranges of your Endpoint Management Servers (e.g., 10.x.x.x for CrowdStrike managers) or filter events where the parent process is the security agent itself (falcon.sys, MsMpEng.exe).
Scenario: Scheduled Threat Intelligence Feed Ingestion by SIEM/EDR
- Context: The organization’s Splunk or SentinelOne instance runs a nightly scheduled job (via Cron on Linux or Windows Task Scheduler) to ingest the latest ThreatFox feed. This process involves parsing JSON files containing Epsilon Stealer indicators, which can generate file access and network connection events matching the rule’s logic.
- Filter/Exclusion: Create an exclusion based on the specific user account running the ingestion job (e.g., svc-threat-intel) or exclude events occurring within a defined maintenance window (e.g., 02:00 – 04:00 UTC) where these scheduled jobs are active.
Scenario: Security Operations Center (SOC) Manual Investigation & Hunting
- Context: SOC analysts often manually run ad-hoc queries or utilize tools like Velociraptor or Sysmon to hunt for