ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the presence of known Indicators of Compromise (IOCs) linked to the Stealc threat actor, which often deploy malicious payloads or establish persistence mechanisms to exfiltrate sensitive data. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC to identify compromised assets early, potentially disrupting the adversary’s operations before they achieve their objective of stealthy data theft.

IOC Summary

Malware Family: Stealc Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`669d803901ca39a60e50067b80f4d77b1d7f6276`	payload	2026-09-08	95%
md5_hash	`5bae18cb6cd8ad345b24cbec6b62a4b9`	payload	2026-09-08	95%
sha256_hash	`b7a06c7dd0943016ee68b5c14ec8a20578df56f9d9fa5f6ea73df6daa5211c07`	payload	2026-09-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Stealc
let malicious_hashes = dynamic(["669d803901ca39a60e50067b80f4d77b1d7f6276", "5bae18cb6cd8ad345b24cbec6b62a4b9", "b7a06c7dd0943016ee68b5c14ec8a20578df56f9d9fa5f6ea73df6daa5211c07"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Scenario: A DevOps team deploys a legacy monitoring agent or a specific third-party endpoint protection tool (e.g., older versions of CrowdStrike Falcon or Carbon Black) that utilizes a unique hash or file path signature matching one of the Stealc IOCs.
- Filter/Exclusion: Exclude the specific executable name or hash if it resides in the standard vendor installation directory (e.g., C:\Program Files\CrowdStrike\ or C:\Program Files\Carbon Black\) and is signed by the known vendor certificate.
Scenario: An IT administrator manually copies a portable version of a utility (such as a specific version of 7-Zip, WinRAR, or a custom internal build script) to a user’s desktop or a shared network drive for temporary use, and the file’s hash matches a Stealc IOC due to a collision or an outdated IOC list.
- Filter/Exclusion: Exclude files located in user-specific directories (C:\Users\<User>\Desktop\ or C:\Users\<User>\Downloads\) or network shares (\\fileserver\public\) if the file creation time is recent (within the last 24-48 hours) and the file is not executing from a system-critical directory.
Scenario: A scheduled maintenance job (e.g., a PowerShell script or a batch file) runs a cleanup or backup routine that temporarily creates a staging file or log file with a name or hash that matches a Stealc IOC, often due to the use of a generic name like temp.exe or update.bin in a non-standard location.
- Filter/Exclusion: Exclude files that are created by known scheduled tasks (verified via schtasks or Task Manager) and are located in the designated temp or log directories (e.g., C:\Windows\Temp\ or `C