ThreatFox: Creal Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Creal Stealer by monitoring for specific indicators of compromise that signal active credential and data theft within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections and prevent lateral movement before sensitive assets are compromised.

IOC Summary

Malware Family: Creal Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`2cacc53c31ebfb5f3dcbccb953a57e19`	payload	2026-07-24	95%
sha256_hash	`eaa828acafc7d731d4f4c64c997b9d72b728c43a94c46ef17a5acb4952152179`	payload	2026-07-24	95%
sha1_hash	`0c1af8f899ec84dee649c0aa0125baddd6e39b86`	payload	2026-07-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Creal Stealer
let malicious_hashes = dynamic(["2cacc53c31ebfb5f3dcbccb953a57e19", "eaa828acafc7d731d4f4c64c997b9d72b728c43a94c46ef17a5acb4952152179", "0c1af8f899ec84dee649c0aa0125baddd6e39b86"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Creal Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Creal Stealer IOCs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

Scenario: Scheduled Endpoint Protection Scans on Development Servers
- Context: In a development environment, servers (e.g., Jenkins or GitLab runners) often host multiple build agents. During nightly maintenance windows, the endpoint protection suite (such as CrowdStrike Falcon or Carbon Black) performs deep heuristic scans that generate high-volume network traffic to external threat intelligence feeds, mimicking the Creal Stealer’s command-and-control (C2) behavior and file hash patterns.
- Filter/Exclusion: Create a rule exclusion based on Host Group membership. Exclude all hosts tagged with Environment=Dev or Role=BuildServer from this specific detection logic, as the traffic is known to be legitimate scanning activity rather than malicious exfiltration.
Scenario: Admin-Driven Software Deployment via SCCM/Intune
- Context: When IT administrators push a new software update (e.g., installing a new version of Microsoft Office or Adobe Acrobat) using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the deployment agents download large payloads from trusted vendor repositories. These downloads often match the specific file hashes and network destinations defined in the Creal Stealer IOCs, triggering alerts during peak deployment hours.
- Filter/Exclusion: Implement a process-based exclusion for known administrative service accounts. Exclude events where the ProcessName matches ccmsetup.exe, intuneagent.exe, or msiexec.exe running under the context of domain admin accounts (e.g., DOMAIN\svc-deployment) during business hours (08:00–18:00).
**Scenario: Automated Backup and