ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific Indicators of Compromise (IOCs) linked to the Stealer malware family, which is known for exfiltrating sensitive credentials and financial data from compromised endpoints. A proactive hunt in Azure Sentinel is essential because early identification of these IOCs allows the SOC team to contain potential lateral movement and prevent large-scale data breaches before the adversary establishes persistence or initiates further exfiltration campaigns.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`b520698c73c6875ceed62b437b049790`	payload	2026-08-01	95%
sha256_hash	`7fd5f3ad0b3a152671dabe440ed5a5a05c640da4fe07a9caacb2f3a88d994596`	payload	2026-08-01	95%
sha1_hash	`ab60377925e8bc95bb066ff30237b834b8fb2b3a`	payload	2026-08-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["b520698c73c6875ceed62b437b049790", "7fd5f3ad0b3a152671dabe440ed5a5a05c640da4fe07a9caacb2f3a88d994596", "ab60377925e8bc95bb066ff30237b834b8fb2b3a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: stealler IOCs detection rule in an enterprise environment:

Endpoint Security Scanning by CrowdStrike or SentinelOne
- Scenario: The organization’s primary EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the network, generating traffic to known Stealer IOCs (such as specific C2 domains or update servers) that overlap with the rule’s signature. This often occurs during off-hours maintenance windows.
- Filter/Exclusion: Exclude process paths matching C:\Program Files\CrowdStrike\FalconSensor\ or C:\Windows\System32\defender.exe where the parent process is the EDR service itself, and restrict alerts to business hours (08:00–18:00) if the scan is known to run at night.
Automated Backup Jobs via Veeam or Commvault
- Scenario: A scheduled backup job utilizing a Stealer-associated URL for license verification or configuration sync triggers the detection. For instance, a nightly Veeam Backup & Replication task contacting stealer-update.cloud to check for plugin updates mimics the behavior of the malicious stealer tool.
- Filter/Exclusion: Create an exclusion rule for source IP ranges belonging to the backup infrastructure (e.g., 10.50.20.0/24) and filter out events where the destination port is 443 and the user context matches a dedicated service account like svc-backup-agent.
IT Admin Deployment via Microsoft Endpoint Configuration Manager (SCCM)
- Scenario: An administrator deploys a new application package or policy update using SCCM, which includes a dependency check against a Stealer IOCs list. The deployment agent