ThreatFox: Stealc IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Stealc malware by matching known Indicators of Compromise (IOCs) within Azure Sentinel logs. A proactive hunt is essential because Stealc’s modular architecture enables advanced data exfiltration and lateral movement, requiring early identification to prevent widespread compromise before automated alerts trigger.

IOC Summary

Malware Family: Stealc Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://144.31.57.113/", "http://91.92.241.69/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Stealc

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Stealc IOCs detection rule in an enterprise environment:

• Scenario: Legitimate Endpoint Protection Updates

  • Context: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During scheduled update cycles, the EDR agent downloads definition signatures and threat intelligence feeds. These updates often contain hashes or network destinations that match known Stealc IOCs (e.g., specific DLLs or C2 domains used by security vendors).
  • Filter/Exclusion: Exclude processes where ProcessName matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe and the ParentProcessName is a known system service (e.g., svchost.exe). Additionally, filter out events occurring within the standard maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Scheduled Backup and Cloud Sync Jobs

  • Context: Enterprise data backup solutions like Veeam Backup & Replication or cloud sync tools such as OneDrive for Business frequently initiate background jobs. These tools often utilize network ports and file signatures that overlap with Stealc’s IOCs, particularly when syncing large datasets to Azure or AWS buckets which may share IP ranges or certificate hashes with the threat signature.
  • Filter/Exclusion: Create an exclusion rule based on ProcessName containing VeeamAgent.exe, OneDrive.exe, or DropboxUpdate.exe. Furthermore, exclude traffic originating from specific internal subnets dedicated to backup infrastructure (e.g., 10.50.x.x) that are whitelisted in the network segmentation policy.

• Scenario: Patch Management and Deployment Tools

  • Context: IT administrators use tools like **Microsoft Endpoint Configuration Manager (SC