ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity by identifying known Indicators of Compromise (IOCs) linked to the Stealc malware family within Azure Sentinel logs. Proactively hunting for these specific signatures allows the SOC team to rapidly identify and contain potential infections before they escalate into broader lateral movement or data exfiltration incidents.

IOC Summary

Malware Family: Stealc Total IOCs: 32 IOC Types: domain, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`23[.]94[.]252[.]4:443`	botnet_cc	2026-08-27	75%
domain	`windows-update-local.rest`	botnet_cc	2026-08-27	100%
url	`hxxp://91[.]92[.]241[.]119/`	botnet_cc	2026-08-27	100%
url	`hxxp://31[.]77[.]228[.]62/`	botnet_cc	2026-08-27	100%
url	`hxxp://80[.]76[.]49[.]106/`	botnet_cc	2026-08-27	100%
url	`hxxp://158[.]94[.]208[.]32/`	botnet_cc	2026-08-27	100%
url	`hxxp://178[.]16[.]52[.]93/`	botnet_cc	2026-08-27	100%
url	`hxxp://103[.]101[.]85[.]184/`	botnet_cc	2026-08-27	100%
url	`hxxp://135[.]181[.]127[.]244/`	botnet_cc	2026-08-27	100%
ip:port	`94[.]103[.]88[.]121:80`	botnet_cc	2026-08-27	75%
ip:port	`95[.]135[.]181[.]73:80`	botnet_cc	2026-08-27	75%
ip:port	`2[.]27[.]5[.]214:80`	botnet_cc	2026-08-27	75%
ip:port	`31[.]77[.]228[.]40:80`	botnet_cc	2026-08-27	75%
ip:port	`31[.]77[.]228[.]62:80`	botnet_cc	2026-08-27	75%
ip:port	`43[.]228[.]157[.]66:80`	botnet_cc	2026-08-27	75%
ip:port	`45[.]88[.]91[.]77:80`	botnet_cc	2026-08-27	75%
ip:port	`78[.]17[.]93[.]167:80`	botnet_cc	2026-08-27	75%
ip:port	`80[.]76[.]49[.]106:80`	botnet_cc	2026-08-27	75%
ip:port	`80[.]76[.]49[.]77:80`	botnet_cc	2026-08-27	75%
ip:port	`91[.]92[.]241[.]119:80`	botnet_cc	2026-08-27	75%
ip:port	`91[.]92[.]241[.]69:80`	botnet_cc	2026-08-27	75%
ip:port	`91[.]92[.]242[.]73:80`	botnet_cc	2026-08-27	75%
ip:port	`196[.]251[.]107[.]163:80`	botnet_cc	2026-08-27	75%
ip:port	`158[.]94[.]209[.]112:80`	botnet_cc	2026-08-27	75%
ip:port	`158[.]94[.]211[.]113:80`	botnet_cc	2026-08-27	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Stealc
let malicious_ips = dynamic(["23.94.252.4", "196.251.107.163", "158.94.211.113", "80.76.49.77", "31.77.228.62", "178.16.52.90", "91.92.241.119", "158.94.208.32", "193.148.56.226", "160.20.109.90", "91.92.241.69", "94.103.88.121", "91.92.242.73", "2.27.5.214", "80.76.49.106", "135.181.127.244", "160.20.109.16", "78.17.93.167", "95.135.181.73", "45.88.91.77", "158.94.209.112", "43.228.157.66", "160.20.109.33", "31.77.228.40"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["23.94.252.4", "196.251.107.163", "158.94.211.113", "80.76.49.77", "31.77.228.62", "178.16.52.90", "91.92.241.119", "158.94.208.32", "193.148.56.226", "160.20.109.90", "91.92.241.69", "94.103.88.121", "91.92.242.73", "2.27.5.214", "80.76.49.106", "135.181.127.244", "160.20.109.16", "78.17.93.167", "95.135.181.73", "45.88.91.77", "158.94.209.112", "43.228.157.66", "160.20.109.33", "31.77.228.40"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Stealc
let malicious_domains = dynamic(["windows-update-local.rest"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://91.92.241.119/", "http://31.77.228.62/", "http://80.76.49.106/", "http://158.94.208.32/", "http://178.16.52.93/", "http://103.101.85.184/", "http://135.181.127.244/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule, along with targeted filters and exclusions:

Scenario: Legitimate Endpoint Detection and Response (EDR) agents performing routine telemetry uploads.
- Context: Tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often communicate with external cloud management portals using IP addresses that may overlap with Stealc’s known command-and-control (C2) infrastructure. These agents frequently initiate outbound HTTPS connections on standard ports (443/80) to upload logs and policy updates.
- Suggested Filter: Exclude traffic originating from specific EDR service accounts or processes (e.g., falcon.sys, MsMpEng.exe) where the destination IP matches known EDR cloud endpoints, regardless of the Stealc IOC match.
Scenario: Scheduled automated backup jobs utilizing external storage gateways.
- Context: Enterprise environments often run nightly scheduled tasks using tools like Veeam Backup & Replication, Rubrik, or Commvault. These agents connect to off-site S3 buckets or specific cloud storage gateways that may share IP ranges with Stealc’s infrastructure, triggering alerts during the backup window (e.g., 02:00–04:00 UTC).
- Suggested Filter: Create a time-based exclusion for the process VeeamAgent.exe or rubrik-agent.service during defined maintenance windows (e.g., Mon-Fri, 01:00–05:00) when connecting to known backup storage IP ranges.
Scenario: Software update mechanisms from major enterprise application suites.
- Context: Applications such as Adobe Creative Cloud, Microsoft Office 365 Click-to-Run, or Salesforce utilize