ThreatFox: stealler IOCs

Hunt Hypothesis

This rule detects adversary behavior involving the Stealer malware family by identifying six specific indicators of compromise that signal active data exfiltration and credential theft within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections, enabling immediate containment before sensitive assets are compromised or lateral movement occurs.

IOC Summary

Malware Family: stealler Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`bfea7c0e2bc57ed3bfe5802377ca3c7545c11c39f13eafaac4fac69815fb63bc`	payload	2026-07-25	95%
sha1_hash	`d3433ca6fab5aecf1d76701cdc1d873e787fa567`	payload	2026-07-25	95%
md5_hash	`09fa7ed361b397cd789e18708fc43247`	payload	2026-07-25	95%
md5_hash	`86d6f85e4756874b1fdf18da35a4265f`	payload	2026-07-25	95%
sha256_hash	`ce5ddcb42bd658184f34c6f2522295eaa252dd578270ceaf9454b7e2cc82e104`	payload	2026-07-25	95%
sha1_hash	`0c8c2dbd432667270cfa60c31ba2bdbbde40003b`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - stealler
let malicious_hashes = dynamic(["bfea7c0e2bc57ed3bfe5802377ca3c7545c11c39f13eafaac4fac69815fb63bc", "d3433ca6fab5aecf1d76701cdc1d873e787fa567", "09fa7ed361b397cd789e18708fc43247", "86d6f85e4756874b1fdf18da35a4265f", "ce5ddcb42bd658184f34c6f2522295eaa252dd578270ceaf9454b7e2cc82e104", "0c8c2dbd432667270cfa60c31ba2bdbbde40003b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — stealler

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: stealler IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Endpoint Protection Scans Triggering Hash Matches
- Context: Enterprise EDR solutions (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently scan the system drive. If a legitimate software installer or update package installed on endpoints contains a file hash that overlaps with one of Stealler’s known IOCs (often common libraries like msvcp140.dll or specific Java JARs), the EDR engine may flag it during routine scanning.
- Filter/Exclusion: Create an exclusion rule for the detection logic to ignore alerts where the process name matches known security agents (MsMpEng.exe, CSFalconService.exe) and the event type is “File Scan” or “Antivirus Action.” Additionally, exclude specific file paths commonly used by patch management tools (e.g., C:\ProgramData\Microsoft\Windows Defender\Updates).
Scenario: Scheduled Backup Jobs Executing Known Utility Binaries
- Context: Automated backup solutions such as Veeam Agent or Acronis Cyber Protect often utilize standard compression and encryption utilities. If the Stealler IOCs include common utility binaries (e.g., 7z.exe, openssl.exe) that are also used by these backup agents, a scheduled nightly job running at 02:00 AM could trigger the rule when accessing network shares or local volumes.
- Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 04:00 on weekdays where the parent process is VeeamAgent.exe or AcronisCyberProtectService. Alternatively, add an exclusion for specific service accounts (e.g., `DOMAIN\