ThreatFox: Phantom Stealer IOCs

Hunt Hypothesis

This rule detects potential compromise by Phantom Stealer, a credential-stealing malware known for targeting Azure AD and other cloud identities, by matching against its specific IOCs. Proactively hunting for these indicators allows the SOC to identify early signs of credential theft and lateral movement before the adversary can establish persistence or exfiltrate sensitive data from the Azure environment.

IOC Summary

Malware Family: Phantom Stealer Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Phantom Stealer
let malicious_hashes = dynamic(["497735f77995080e7d677b465b22c36c33ad6065", "7ab123e9e6b30c85ce2432cd10a0c1c6", "70501144a459b9fdbc8b6e549fbc08db479b7d7aab4e02a352b3f11ba1ec686a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Phantom Stealer

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to deploy a new version of a web application, where the build artifact or container image hash matches one of the Phantom Stealer IOCs due to a shared dependency library or base image.

  • Filter/Exclusion: Exclude alerts where the process path originates from standard CI/CD agent directories (e.g., C:\Program Files\Jenkins\, D:\GitHub\actions-runner\) or where the parent process is a known build tool (msbuild.exe, dotnet.exe, java.exe).

• Scenario: An IT support team member runs a portable version of a legitimate utility (e.g., a specific version of 7-Zip or a custom internal script) that has been digitally signed or compiled with a toolchain that results in a file hash matching the IOC, often because the tool was downloaded from a non-standard internal share.

  • Filter/Exclusion: Exclude alerts where the file has a valid digital signature from a trusted internal CA or vendor, or where the file location is within designated “Approved Tools” directories (e.g., \\corp\tools\approved\).

• Scenario: A security team performs a manual threat hunt or validation test by downloading the Phantom Stealer sample or a known benign file with the same hash to verify detection coverage, placing it in a temporary folder like C:\Temp or C:\Users\Analyst\Downloads.

  • Filter/Exclusion: Exclude alerts where the user account belongs to the SecurityTeam or SOCAnalysts group, or where the file path contains keywords like \Temp\, \Downloads\, or \Hunt\.

• Scenario: A legacy application or third-party plugin (e.g., an old Java applet or a specific PDF reader plugin