ThreatFox: RevStealer IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the RevStealer malware by identifying known Indicators of Compromise (IOCs) that signal potential credential theft and sensitive data exfiltration. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly isolate compromised endpoints before attackers can leverage stolen credentials for lateral movement or persistent access within the organization’s cloud infrastructure.

IOC Summary

Malware Family: RevStealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["gate.runmanor.click", "hub4.cdndock.click"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: RevStealer IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Security Scans by Endpoint Protection Agents

  • Context: Enterprise endpoints (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) often perform scheduled network scans or cloud-based threat intelligence updates that connect to known ThreatIntel feeds. If the RevStealer IOCs overlap with a legitimate feed URL or hash used by these agents during their daily update cycle, the rule triggers.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., MDE-Update-Svc or CrowdStrike-Cfg) and filter out connections to known internal IP ranges of the Security Operations Center (SOC) where threat intelligence feeds are hosted.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Legacy backup solutions like Veeam Backup & Replication or Commvault often utilize external connectors that download configuration manifests or encryption keys from cloud repositories. If these tools access a URL or file hash matching the RevStealer IOCs during their nightly 02:00 AM window, they generate false alerts.
  • Filter/Exclusion: Create an exclusion rule based on process names (e.g., vbrservice.exe, commvaultagent.exe) and restrict the detection to only trigger outside of standard maintenance windows (e.g., 02:00–04:00 AM) for these specific backup processes.

• Scenario: Development Environment CI/CD Pipeline Artifacts

  • Context: In DevOps environments, tools like Jenkins or Azure DevOps Agents frequently pull dependencies and build artifacts from public repositories (e.g., GitHub Packages, Docker Hub). If a build pipeline downloads a library container image that shares a hash with the RevStealer