ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies adversary activity involving the Stealc malware by monitoring for three specific Indicators of Compromise (IOCs) known to be associated with its infection and command-and-control behaviors. SOC teams should proactively hunt for these signals within Azure Sentinel to enable early discovery of Stealc infections, thereby minimizing dwell time and preventing potential data exfiltration or lateral movement before the threat escalates.

IOC Summary

Malware Family: Stealc Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`5ece5582a6cca57b558b5a98290b3699`	payload	2026-08-15	95%
sha256_hash	`7e52031a2ef388824fd6e39f25b626b09be13e33a79d291a4790affdb9b93593`	payload	2026-08-15	95%
sha1_hash	`76b7d9208456ddfd5a59c99826af2217c3f86168`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Stealc
let malicious_hashes = dynamic(["5ece5582a6cca57b558b5a98290b3699", "7e52031a2ef388824fd6e39f25b626b09be13e33a79d291a4790affdb9b93593", "76b7d9208456ddfd5a59c99826af2217c3f86168"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

Scenario: Automated Endpoint Protection Scanning
- Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) periodically scan the system registry and file system. During a scheduled “Deep Scan” or definition update, the agent may generate network traffic or process creation events that match Stealc’s known IOCs (specifically hash values of legitimate DLLs used by the EDR itself).
- Filter/Exclusion: Create an exclusion rule to suppress alerts where the Process Name matches the EDR service executable (e.g., MsMpEng.exe, csagent.exe) and the Parent Process Name is the same EDR service. Additionally, exclude traffic originating from the specific Source IP ranges of the internal EDR management servers.
Scenario: Scheduled Group Policy Updates
- Context: During off-hours (e.g., 02:00–04:00), Domain Controllers push new Group Policies to workstations via the gpupdate.exe process. These updates often involve downloading configuration files or scripts from internal file servers that share similar hash signatures or network ports with Stealc’s command-and-control (C2) infrastructure, triggering a match on the “Network Connection” IOC.
- Filter/Exclusion: Implement a time-based filter to exclude alerts occurring between 01:00 and 05:00 local time for processes named gpupdate.exe. Alternatively, add a rule exclusion if the Destination IP belongs to the internal Active Directory subnet (e.g., 192.168.x.x) rather than external public IPs.
**Scenario: Third-Party Software Deployment via SCC