ThreatFox: Stealc IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with the Stealc malware family to identify potential active infections or persistence mechanisms within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised assets before the adversary can leverage the malware for data exfiltration or lateral movement.

This hunt targets known indicators of compromise associated with the Stealc malware family to identify potential active infections or persistence mechanisms within the environment. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised assets before the adversary can leverage the malware for data exfiltration or lateral movement.

IOC Summary

Malware Family: Stealc Total IOCs: 9 IOC Types: md5_hash, sha1_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Stealc
let malicious_hashes = dynamic(["f8deb8841e372835eb3dae09ebc24f8a132e20fb", "3838383758c4f2354b1e4aaa6840cc6c", "8e863c4489957c085515aba5f1f56eb53b53306bd3283f450362bdcd31248962", "4d8603a496d9d2bcfba6e7d092cc1339deb87478", "cda39433b0b4980a3aef36c5e371e4d3", "00147abaca1263e02190ac12e15ab0db45bf250ef2dae53e945a9d8b40c01598", "43a22e2bcb9bdcf5e4692906b151d9c38b47a07d", "5bdadffb81a4b1129d1bcc6d416f33cc", "833b18e7aabec330c7dc81ead53795d9e60b544658d31bf462e816402afafaea"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Stealc

False Positive Guidance

• Legacy Application Maintenance Scripts: Old internal tools or vendor-provided scripts (e.g., Python or PowerShell) that have not been updated in years may still reference outdated Stealc IOCs (such as specific file hashes or registry keys) for compatibility checks or logging purposes.
  • Filter/Exclusion: Exclude processes where the parent process is a known legacy interpreter (e.g., python.exe, pwsh.exe) and the working directory is within a designated legacy application folder (e.g., C:\Apps\LegacyVendorTool\).
• Security Baseline Verification Jobs: Scheduled tasks or GPO-based scripts run by IT operations to verify endpoint compliance or detect known malware signatures may intentionally create temporary files or registry entries matching Stealc IOCs to test detection coverage or validate baseline states.
  • Filter/Exclusion: Exclude events where the initiating process is schtasks.exe or Task Scheduler service, and the command line contains keywords like baseline_check, compliance_verify, or ioc_test.
• Backup and Restore Operations: Enterprise backup solutions (e.g., Veeam, Commvault) or restore operations may temporarily instantiate files or registry keys associated with known threats to ensure integrity or during specific restoration workflows, especially if the backup image contains a known infected or test file.
  • Filter/Exclusion: Exclude events where the parent process is a known backup agent (e.g., VeeamBackup.exe, cvbackup.exe) or the file path resides within a standard backup scratch directory (e.g., C:\ProgramData\Veeam\Backup\).
• Development and QA Environments: Developers or QA engineers testing security features or reproducing known vulnerabilities may intentionally deploy Stealc IOCs in isolated test environments or containers to validate detection rules before production rollout.
  • Filter/Exclusion: Exclude hosts tagged with `Environment: