ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity by matching network and endpoint telemetry against six specific Indicators of Compromise (IOCs) linked to the Stealc malware family. Proactively hunting for these IOCs in Azure Sentinel is critical because Stealc’s dual nature as both a stealer and a loader often serves as an initial foothold for broader post-exploitation campaigns, necessitating early identification to prevent lateral movement and data exfiltration.

IOC Summary

Malware Family: Stealc Total IOCs: 6 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://91[.]92[.]34[.]11/`	botnet_cc	2026-08-13	100%
url	`hxxp://78[.]17[.]93[.]167/`	botnet_cc	2026-08-13	100%
url	`hxxps://cloud-flare-authenticator.link/`	botnet_cc	2026-08-13	100%
url	`hxxp://144[.]31[.]57[.]92/`	botnet_cc	2026-08-13	100%
url	`hxxp://91[.]202[.]233[.]163/`	botnet_cc	2026-08-13	100%
url	`hxxps://fbdfsgfwrgerwefew.top/`	botnet_cc	2026-08-13	100%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://91.92.34.11/", "http://78.17.93.167/", "https://cloud-flare-authenticator.link/", "http://144.31.57.92/", "http://91.202.233.163/", "https://fbdfsgfwrgerwefew.top/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule, along with targeted filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Software Deployment via Admin Tooling
- Context: System administrators frequently use tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to push software updates. These deployments often involve downloading installers from trusted repositories that share hash signatures or network destinations with Stealc IOCs, triggering the rule when a specific installer is staged on an endpoint.
- Suggested Filter/Exclusion: Create a process exclusion for ccmexec.exe (SCCM) and ivanti_agent.exe. Additionally, add a filter to exclude alerts where the parent process is a known management tool running under a domain admin account (e.g., DOMAIN\AdminUser) rather than an interactive user session.
Scenario: Scheduled Antivirus or EDR Definition Updates
- Context: Enterprise security suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs to fetch the latest threat intelligence feeds and definition updates. These background services often connect to update servers that may match Stealc’s network IOCs (IP addresses) or file hashes, causing false triggers during maintenance windows.
- Suggested Filter/Exclusion: Exclude alerts originating from processes named CrdSvc.exe (CrowdStrike), SentinelOne.exe, and MsMpEng.exe. Implement a time-based filter to suppress detections between 02:00 and 04:00 local time, which is the standard maintenance window for these update jobs.
Scenario: Internal DevOps Artifact Retrieval
- Context: Development teams utilize internal artifact repositories like Azure Artifacts, **JFrog