ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt targets the presence of specific IOCs linked to the SalatStealer infostealer, a high-severity threat known for harvesting sensitive data and credentials from compromised endpoints. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify and isolate infected assets before the adversary can exfiltrate data or establish persistence, thereby reducing the overall risk to the organization.

IOC Summary

Malware Family: SalatStealer Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`e97e94bd9be61e85a813c45bf145086459fc13e8`	payload	2026-09-12	95%
md5_hash	`0f984f764812044c4268742c0d6ecf97`	payload	2026-09-12	95%
md5_hash	`248977b62d5d3c2961fec8e1c2ed5644`	payload	2026-09-12	95%
sha256_hash	`651666ccc18b31d0d24a6d5d33062d45ed859981f84024bc69d710b468d9870f`	payload	2026-09-12	95%
sha256_hash	`2d3b179077f5a7aea77c70ef7e4219905c2b50680c514e9d3474825fe49f3ce7`	payload	2026-09-12	95%
sha1_hash	`7b8ea5455c89d33ced4a58df77ca50e8d8ac1ce4`	payload	2026-09-12	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["e97e94bd9be61e85a813c45bf145086459fc13e8", "0f984f764812044c4268742c0d6ecf97", "248977b62d5d3c2961fec8e1c2ed5644", "651666ccc18b31d0d24a6d5d33062d45ed859981f84024bc69d710b468d9870f", "2d3b179077f5a7aea77c70ef7e4219905c2b50680c514e9d3474825fe49f3ce7", "7b8ea5455c89d33ced4a58df77ca50e8d8ac1ce4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Scenario: A DevOps team deploys a custom PowerShell script to automate the cleanup of temporary files and application caches across a fleet of Windows servers. The script explicitly iterates through known cache directories (e.g., %TEMP%, AppData\Local\Temp) and deletes files matching specific patterns, which overlaps with the SalatStealer IOCs targeting common data exfiltration paths.
- Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or pwsh.exe and the command line contains specific automation markers like -ExecutionPolicy Bypass or known internal script names (e.g., Clean-Cache.ps1). Additionally, exclude if the user account belongs to a service account or a specific DevOps group (e.g., DOMAIN\DevOps-Auto).
Scenario: An IT administrator performs a manual audit of user profiles on a domain controller to identify orphaned or stale user data. They use a native Windows tool like rsync (via Cygwin/WSL) or a custom batch script to move or delete specific folders under C:\Users\Public or C:\Users\Default that match the IOCs for common stealer targets (e.g., browser, wallet, config subdirectories).
- Filter/Exclusion: Exclude if the initiating process is a known administrative utility (e.g., cmd.exe, powershell.exe) and the user is a member of the Domain Admins or IT-Admins group. Add a condition to ignore if the file path is under C:\Users\Public or C:\Users\Default and the action is Move or Delete rather than Read or Copy to a non-standard location.
Scenario: A security team runs a YARA scan or a custom detection script on endpoint