ThreatFox: RevStealer IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) from the RevStealer malware, which is designed to exfiltrate sensitive browser data such as credentials and cookies. The SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections that could lead to widespread credential theft and unauthorized access before the threat escalates.

IOC Summary

Malware Family: RevStealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["pull.valley-screen.click", "stage.vibedisplay32.one"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: RevStealer IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Scanning of Known Malware Definitions

  • Scenario: Managed Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically download and process updated malware definition signatures. These signature files often contain embedded hashes or URLs that match the RevStealer IOCs, triggering a false alert during the background update cycle.
  • Filter/Exclusion: Create an exclusion rule based on the EDR service account (e.g., MSSQL$EDR_SERVICE or SYSTEM) and exclude processes named C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe or C:\Windows\System32\mpcmdrun.exe when accessing known update repositories.

• Scheduled Backup Jobs Accessing Cloud Storage

  • Scenario: Automated backup solutions (e.g., Veeam Backup & Replication or Commvault) running on a daily schedule may initiate connections to cloud storage buckets or SaaS applications that utilize the same domain names or IP addresses listed in the RevStealer IOC set. This is common when backing up data from CRM systems like Salesforce or Office 365 which share infrastructure with the threat indicators.
  • Filter/Exclusion: Exclude network traffic and process execution originating from specific backup service accounts (e.g., DOMAIN\BackupService) during defined maintenance windows (e.g., 02:00–04:00 UTC) where these jobs are known to run.

• IT Admin Tasks Involving Browser-Based Configuration

  • Scenario: System administrators performing routine configuration tasks via web browsers (Chrome/Edge) may visit documentation portals, vendor support sites,