ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving Unknown Stealer malware by identifying specific Indicators of Compromise (IOCs) that signal active data exfiltration and credential theft within the environment. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage infections before they escalate into broader compromises, leveraging high-severity alerts to prioritize immediate incident response actions.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown Stealer
let malicious_ips = dynamic(["93.152.223.30"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["93.152.223.30"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown Stealer
let malicious_urls = dynamic(["http://93.152.223.30:5000/api/stealer/report"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown Stealer IOCs rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scans by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background scans that generate network traffic to known security vendor update servers. These connections often match generic IOCs associated with stealer families because they involve downloading large configuration files or telemetry data over HTTPS, which can mimic the behavior of a credential stealer exfiltrating data.
  • Filter/Exclusion: Create an exclusion rule based on Process Name and Parent Process. Exclude traffic where the process name is FalconSensor.exe, MsMpEng.exe, or SentinelOneAgent.exe AND the parent process is a known system service (e.g., System or svchost.exe). Additionally, whitelist specific destination IP ranges belonging to these vendors’ update clusters.

• Scenario: Scheduled Backup and Synchronization Jobs

  • Context: IT administrators often schedule nightly backup jobs using tools like Veeam, Rubrik, or cloud sync utilities like OneDrive for Business and Box Sync. These tasks frequently initiate connections to external storage endpoints that may share IP addresses or domain patterns with the “Unknown Stealer” IOCs. The high volume of data transfer during these windows can trigger the rule, mistaking legitimate backup exfiltration for malicious activity.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 02:00 – 06:00 local time) combined with a Process Path filter. Exclude alerts where the process path contains \Program Files\Microsoft OneDrive\,