ThreatFox: stealler IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving the Stealer malware by monitoring for three specific Indicators of Compromise (IOCs) known to facilitate credential theft and data exfiltration. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly detect early-stage infections, thereby preventing lateral movement and minimizing potential data loss before the threat escalates.

IOC Summary

Malware Family: stealler Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`128d921b2200fa96cae6076c7e44b6359e8bff22`	payload	2026-07-31	95%
md5_hash	`511f859cacc58d37186eb3262362ce4b`	payload	2026-07-31	95%
sha256_hash	`a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["128d921b2200fa96cae6076c7e44b6359e8bff22", "511f859cacc58d37186eb3262362ce4b", "a6f0cbcb7f2c1d46f27fa4d84c18718e77a7151d25933e62073231a08383a012"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: stealler IOCs detection rule, along with targeted filters and exclusions tailored for an enterprise environment:

Scenario: Automated Backup Agent Scanning Stealer Artifacts
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often scan the entire file system. If a legitimate user has previously downloaded a “Stealler” sample (e.g., from an EDR vendor’s threat library) into their local Downloads folder, the backup agent may generate network traffic or process execution logs matching Stealer IOCs during its nightly job window.
- Filter/Exclusion: Exclude processes where the parent process is a known backup service (e.g., VeeamTransport.exe, rubrik-agent.exe) and the file path resides within standard backup staging directories (e.g., C:\ProgramData\Veeam\Backup...).
Scenario: Endpoint DLP Policy Enforcement on User Downloads
- Context: Data Loss Prevention (DLP) tools such as Symantec DLP or Microsoft Purview actively monitor file downloads from the internet. When a user downloads a legitimate software installer that shares a hash or network signature with Stealer IOCs, the DLP engine may trigger an alert by inspecting the download stream, mimicking the behavior of the Stealer detection logic.
- Filter/Exclusion: Create a rule to suppress alerts where the source IP belongs to trusted internal proxy ranges (e.g., 10.x.x.x) and the file extension is .msi or .exe originating from approved software repositories (e.g., GoToMyPC, Zoom).
Scenario: Scheduled Security Scans by EDR Agents
- Context: Enterprise EDR agents like **