ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This detection rule identifies the presence of five critical Indicators of Compromise (IOCs) linked to the Unknown Stealer malware, which is known for exfiltrating sensitive credentials and personal data from compromised endpoints. Proactively hunting for these IOCs within Azure Sentinel allows the SOC team to rapidly detect early-stage infections before the adversary establishes persistence or initiates large-scale data theft operations.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 5 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["pawsockenjoyer.site"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Stealer
let malicious_urls = dynamic(["https://pawsockenjoyer.site/api/hwid", "https://pawsockenjoyer.site/v1/stats", "https://pawsockenjoyer.site/v1/webhook", "https://pawsockenjoyer.site/v1/poll"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

False Positive Scenarios for “ThreatFox: Unknown Stealer IOCs”

• Scenario: Automated backup agents (e.g., Veeam Backup & Replication or Rubrik) scanning the network to identify new endpoints often generate traffic matching generic stealer signatures when probing unknown subnets.

  • Filter/Exclusion: Create a rule exclusion for source IP ranges belonging to the backup infrastructure and filter out process names containing vbrservice.exe or rubrik-agent.

• Scenario: Scheduled Windows Update tasks running via Task Scheduler (specifically the usocd.exe or DoSvc processes) initiating outbound connections to Microsoft update servers that may contain IOCs overlapping with stealer behavior.

  • Filter/Exclusion: Exclude traffic where the destination domain ends in .microsoft.com and the source process is svchost.exe running under the “Windows Update” service context.

• Scenario: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or SentinelOne performing periodic telemetry uploads to their cloud management consoles, which can mimic the network signatures of data exfiltration stealers.

  • Filter/Exclusion: Whitelist the specific EDR service processes (FalconSensor.exe, SoneAgent.exe) and exclude any outbound connections to known vendor FQDNs (e.g., *.falcon.crowdstrike.com).

• Scenario: IT administrators running manual discovery scripts using tools like PowerShell or Ansible Tower to inventory new hardware, which triggers network probes that resemble the initial reconnaissance phase of a stealer.

  • Filter/Exclusion: Exclude events where the parent process is powershell.exe initiated by a domain admin account (e.g., DOMAIN\AdminUser) and the command line contains keywords like “Inventory”