← Back to SOC feed Coverage →

ThreatFox: StrelaStealer IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
infostealeriocthreatfoxwin-strelastealer
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-04T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy the StrelaStealer infostealer to exfiltrate sensitive credentials and browser data using a known set of 51 Indicators of Compromise (IOCs). Proactively hunting for these specific signatures in Azure Sentinel is critical because it enables the SOC team to identify early-stage infections before lateral movement occurs, ensuring rapid containment of this high-severity threat.

IOC Summary

Malware Family: StrelaStealer Total IOCs: 51 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainwww.ardmorehp.orgpayload_delivery2026-07-04100%
domainrealhair.com.trpayload_delivery2026-07-04100%
domain13espacioarte.compayload_delivery2026-07-04100%
domainabasket.itpayload_delivery2026-07-04100%
domainadamantgrup.rupayload_delivery2026-07-04100%
domainabhinavpharmacycollege.orgpayload_delivery2026-07-04100%
domainactivefoods.nopayload_delivery2026-07-04100%
domainamala-sa.compayload_delivery2026-07-04100%
domainamigo-canino.plpayload_delivery2026-07-04100%
domainandroscogginpal.compayload_delivery2026-07-04100%
domainannewatson.compayload_delivery2026-07-04100%
domainarizonaplumbingworks.compayload_delivery2026-07-04100%
domainarchouse.orgpayload_delivery2026-07-04100%
domainaristos-limousine.compayload_delivery2026-07-04100%
domainartedco.orgpayload_delivery2026-07-04100%
domainas23.depayload_delivery2026-07-04100%
domainatelier-du-fauteuil.frpayload_delivery2026-07-04100%
domainateliergalerie-leslie.compayload_delivery2026-07-04100%
domainauburnkoreanchurch.orgpayload_delivery2026-07-04100%
domainbaufoerderung.depayload_delivery2026-07-04100%
domainbedfordvatowing.compayload_delivery2026-07-04100%
domainblechbar.depayload_delivery2026-07-04100%
domainbmservice.nlpayload_delivery2026-07-04100%
domainbouwbedrijfjongsma.nlpayload_delivery2026-07-04100%
domainbrainding.gepayload_delivery2026-07-04100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - StrelaStealer
let malicious_domains = dynamic(["www.ardmorehp.org", "realhair.com.tr", "13espacioarte.com", "abasket.it", "adamantgrup.ru", "abhinavpharmacycollege.org", "activefoods.no", "amala-sa.com", "amigo-canino.pl", "androscogginpal.com", "annewatson.com", "arizonaplumbingworks.com", "archouse.org", "aristos-limousine.com", "artedco.org", "as23.de", "atelier-du-fauteuil.fr", "ateliergalerie-leslie.com", "auburnkoreanchurch.org", "baufoerderung.de", "bedfordvatowing.com", "blechbar.de", "bmservice.nl", "bouwbedrijfjongsma.nl", "brainding.ge", "brnbed.com", "carguxlogistics.com", "christiansforbiblicalisrael.org", "cbibplus.eu", "coachsocialfamilias.com", "detoxlibrary.com", "debraemarvin.com", "dmsdiagnostics.com", "larcomsa.com", "liza.co.za", "brandearte.com.sv", "maga-tools.com", "mizellroofingmobilealabama.com", "murosderocalla.com", "nataska-legavyh.ru", "neuburg-donau.biz", "dsglobal.nl", "fission3.com", "greeceweddingphotography.com", "pate-intelligente.fr", "dellpro-info.de", "bs-buitengewoon.nl", "javistowing.com", "adenapez.com", "renatotelli.com.br"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: StrelaStealer IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

Original source: https://threatfox.abuse.ch/browse/malware/win.strelastealer/