ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the Stealer malware by monitoring for three specific indicators of compromise that signal potential data exfiltration and credential theft. Proactive hunting in Azure Sentinel is critical to rapidly isolate affected endpoints and prevent lateral movement before sensitive information is compromised.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`7dee819b76bf7a145dc60d279411b721`	payload	2026-08-07	95%
sha256_hash	`d42b84a94d990cb280c33739284c7a2318e466754584d9c99de7fca99d650157`	payload	2026-08-07	95%
sha1_hash	`19da7a33ccc9c5cf690f7cc9dcca33cd04c95e6f`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["7dee819b76bf7a145dc60d279411b721", "d42b84a94d990cb280c33739284c7a2318e466754584d9c99de7fca99d650157", "19da7a33ccc9c5cf690f7cc9dcca33cd04c95e6f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: stealler IOCs detection rule, along with targeted filtering strategies:

Endpoint Protection Scans by Admin Tools
- Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black perform scheduled deep scans of the file system. These tools often download threat intelligence feeds containing Stealer signatures, generating network traffic or process creation events that match Stealer IOCs (e.g., specific hash values or domain connections used in the feed).
- Filter/Exclusion: Exclude processes where ProcessName matches known EDR service executables (e.g., FalconSensorService.exe, MsMpEng.exe) and restrict alerts to non-system accounts. Add a filter: NOT ProcessImage IN ('C:\Program Files\CrowdStrike\FalconSensor\...', 'C:\ProgramData\Microsoft\Windows Defender\...').
Scheduled Backup Jobs Accessing Shared Data
- Scenario: Automated backup solutions such as Veeam Backup & Replication, Rubrik, or Acronis Cyber Protect run nightly jobs that enumerate and copy user data from shared network drives. If the Stealer IOCs include specific file extensions (e.g., .docx, .xlsx) or registry keys related to document access, these backup agents may trigger hits while indexing large volumes of legitimate corporate documents.
- Filter/Exclusion: Create an exclusion for accounts belonging to service groups like BackupServiceAccount or VeeamSystem. Filter logic: AND AccountName NOT IN ('DOMAIN\VeeamBackup', 'DOMAIN\AcronisAgent') AND ProcessImage CONTAINS 'backup'.
Software Deployment via Configuration Management
- Scenario: IT Operations teams utilize