ThreatFox: Stealc IOCs

Hunt Hypothesis

This detection rule identifies adversary activity linked to the Stealc information stealer by monitoring for specific Indicators of Compromise (IOCs) known to facilitate credential theft and data exfiltration. Proactively hunting for these IOCs within Azure Sentinel is critical because early identification of Stealc infections allows SOC teams to mitigate lateral movement risks before sensitive assets are compromised.

IOC Summary

Malware Family: Stealc Total IOCs: 2 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Stealc
let malicious_ips = dynamic(["176.65.144.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.65.144.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://176.65.144.127/312b423bf6dd463f8d15.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Stealc

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scan the C:\ProgramData\ThreatFox\Quarantine directory. When these agents extract and analyze archived malware samples containing Stealc artifacts for signature updates, they may trigger network connections to Stealc-associated IOCs (e.g., specific C2 domains) that are part of the sample’s embedded configuration rather than an active infection on the host.
  • Filter/Exclusion: Exclude processes belonging to known security vendors from triggering this rule. Add a filter for ProcessName containing “CrowdStrike”, “MsMpEng.exe”, or “SentinelOne” where the ParentProcessName is the EDR service itself, and the action is limited to file I/O or local network scanning rather than outbound C2 communication.

• Scheduled Threat Intelligence Feed Synchronization

  • Scenario: The organization utilizes a centralized threat intelligence platform like Tenable.io or Recorded Future. A scheduled job (e.g., running daily at 03:00 UTC via Windows Task Scheduler) downloads the latest IOC feeds from ThreatFox to update local SIEM correlation rules. During this synchronization, the management server establishes connections to Stealc IOCs listed in the feed metadata to validate hash availability or fetch additional context, mimicking the behavior of a compromised host communicating with a C2 server.
  • Filter/Exclusion: Create an exclusion based on SourceHost belonging to the “SIEM-Management” or “ThreatIntel-Sync” asset group. Additionally, filter for specific scheduled