ThreatFox: stealler IOCs

Hunt Hypothesis

This hunt targets the presence of known indicators of compromise associated with the Stealler infostealer, a tool frequently used by adversaries to exfiltrate sensitive data such as credentials and browser history. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints early, mitigating the risk of persistent data theft and lateral movement before the adversary achieves their objectives.

This hunt targets the presence of known indicators of compromise associated with the Stealler infostealer, a tool frequently used by adversaries to exfiltrate sensitive data such as credentials and browser history. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints early, mitigating the risk of persistent data theft and lateral movement before the adversary achieves their objectives.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["a5181dd5da1137c6d2e88acdc1ff32fd", "1ad42cab7899671275d79ff38317ae4df61d58de9d2e4f23facf297b5b33654b", "fc3874454b6ecbd71ca4364f26f78cc99dd872cb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — stealler

False Positive Guidance

• Scenario: A DevOps engineer uses Terraform or Ansible to provision new virtual machines, where the initialization scripts (e.g., cloud-init or user-data) contain hardcoded base64-encoded configuration strings or API keys that match the IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is terraform, ansible-playbook, or cloud-init, or filter out events where the command line contains base64 and the user context is a service account (e.g., svc-terraform).
• Scenario: An IT administrator runs Sysinternals PsExec to execute a remote diagnostic script on a domain controller, and the script includes a checksum verification step that reads a file containing the specific hash or string associated with the stealer IOCs.
  • Filter/Exclusion: Exclude events where the process name is PSEXEC.EXE or PsExec.exe and the user belongs to the Domain Admins or Server Operators group, specifically when the action is ReadFile or ProcessStart with a command line referencing verify or checksum.
• Scenario: A security engineer performs a YARA rule scan using YARA or ClamAV on a shared network drive to validate new detection signatures, causing the scanner process to read files that contain the known stealer IOCs as part of the test corpus.
  • Filter/Exclusion: Exclude events where the process name is yara.exe, clamscan.exe, or yara64.exe, and the user is a member of the Security Team or SOC Analysts group, particularly when the file path resides in a designated C:\Temp\YaraTests or D:\DetectionCorpus directory.
• Scenario: A