ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Stealer malware family, which is known for exfiltrating sensitive credentials and financial data from compromised endpoints. The SOC team should proactively hunt for these IOCs within Azure Sentinel to rapidly detect early-stage infections and prevent potential lateral movement or data breaches before the threat escalates.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`11b388e073236318b3851c168aa1abde`	payload	2026-08-08	95%
sha256_hash	`254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b`	payload	2026-08-08	95%
sha1_hash	`3b2ce84bea55b35c195a046f40dd838931960270`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["11b388e073236318b3851c168aa1abde", "254412f2ca69b69f8b686f874374e2584aaf55ad5c3e8ed6eddfa69f3fe6ea2b", "3b2ce84bea55b35c195a046f40dd838931960270"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: stealler IOCs detection rule:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The enterprise’s endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled deep scan of the “Quarantine” folder. This process extracts and analyzes archived threat samples that contain known Stealer signatures, triggering the rule even though these are benign historical artifacts rather than active infections.
- Filter/Exclusion: Exclude processes belonging to the endpoint protection service (e.g., MsMpEng.exe, FalconSensorService) when they access paths containing “Quarantine” or “Threats”. Additionally, filter out events where the file age is greater than 30 days.
IT Admin Manual Artifact Analysis
- Scenario: A Security Operations analyst or IT administrator manually downloads a known Stealer sample (e.g., from VirusTotal) onto their workstation to perform offline analysis using tools like Process Monitor or Wireshark. The detection logic captures the IOCs associated with this manual review session as an active threat.
- Filter/Exclusion: Create an exclusion for specific admin user accounts (e.g., members of the “Security Analysts” AD group) and exclude execution paths restricted to the analyst’s personal work directories (e.g., C:\Users\<AdminName>\Downloads\Analysis).
Automated Backup and Archive Jobs
- Scenario: Scheduled backup jobs using tools like Veeam or Commvault process large data repositories that include legacy application logs or configuration files containing Stealer-related metadata. The backup engine reads these files, causing the detection logic to match the IOCs against the backup stream rather than a live user session.
- Filter/Exclusion: Exclude processes