ThreatFox: FaceStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of FaceStealer malware, which targets credential theft and system compromise through specific Indicators of Compromise (IOCs). A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections and prevent lateral movement before sensitive data is exfiltrated.

IOC Summary

Malware Family: FaceStealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`7707d9dcb3332125863f4432f75d3026d5439899`	payload	2026-07-25	95%
md5_hash	`04cb543da02c2227c4ec3a17d72d41fb`	payload	2026-07-25	95%
sha256_hash	`d33fe738471c6f21f7f9c2c56893c5e286f110bb0eb242ec1b3f9145fccdaf79`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - FaceStealer
let malicious_hashes = dynamic(["7707d9dcb3332125863f4432f75d3026d5439899", "04cb543da02c2227c4ec3a17d72d41fb", "d33fe738471c6f21f7f9c2c56893c5e286f110bb0eb242ec1b3f9145fccdaf79"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — FaceStealer

False Positive Guidance

Here are specific false positive scenarios and corresponding mitigation strategies for the ThreatFox: FaceStealer IOCs rule in an enterprise environment:

Scenario: Automated Endpoint Protection Updates
- Context: Enterprise EDR agents (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently download definition updates or threat intelligence feeds that contain hashes matching the known FaceStealer IOCs. These downloads often occur during scheduled maintenance windows and trigger network connections to vendor update servers.
- Filter/Exclusion: Create a detection exclusion based on the Process Name (e.g., MsMpEng.exe, FalconSensorService.exe) or exclude traffic originating from specific Update Server IP ranges defined by the EDR vendor’s documentation.
Scenario: Scheduled Backup and Archive Jobs
- Context: Automated backup solutions (e.g., Veeam, Commvault) often scan large volumes of user data, including legacy archives containing documents or images previously flagged as potential threats in other contexts. If the backup engine scans a file with a hash matching the FaceStealer IOCs during its nightly run, it may trigger an alert despite the file being a benign artifact within the backup repository.
- Filter/Exclusion: Implement a rule exclusion for processes running under specific Service Accounts (e.g., DOMAIN\BackupSvc) or exclude alerts where the File Path resides in dedicated backup storage locations (e.g., \\BackupServer\ArchiveData\).
Scenario: Software Deployment and Patching via Configuration Management
- Context: IT administrators using tools like Microsoft SCCM, Ansible, or Puppet may deploy software packages that include shared libraries or dependencies known to share hashes with FaceStealer IOCs. During a mass deployment event, multiple endpoints simultaneously execute the installer, causing a spike in detections across the network.