ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This rule detects the presence of ACR Stealer malware, a credential-harvesting tool that exfiltrates sensitive data such as usernames, passwords, and browser credentials from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy credential theft operations that may precede lateral movement or privilege escalation within the environment.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["wss.scriptlab.cc", "sso.activeloop.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

• Scenario: Automated Browser Credential Backup via PowerShell

  • Context: An IT operations team uses a scheduled PowerShell script to periodically export Chrome and Firefox credential databases (Login Data, logins.json) to a secure internal share for disaster recovery purposes. The script reads the local credential files and compresses them, which may match the “exfiltration of browser credentials” logic if the rule inspects file access patterns or specific registry keys associated with browser password stores.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific keywords like Export-LoginData or Copy-Item targeting known browser profile paths (e.g., AppData\Local\Google\Chrome\User Data). Alternatively, whitelist the specific service account used for the backup job.

• Scenario: Enterprise Password Manager Synchronization

  • Context: A corporate password manager (e.g., 1Password, Bitwarden, or LastPass) runs a background service that periodically syncs local vault data with the cloud. This process involves reading local credential storage files and establishing outbound HTTPS connections to the vendor’s API endpoints. If the rule triggers on outbound connections from processes known to handle credential data, this legitimate sync will be flagged.
  • Filter/Exclusion: Whitelist the specific executable names of the password manager (e.g., 1Password.exe, bitwarden.exe) and their associated helper processes. Ensure the exclusion applies to both the process creation and the network connection events if the rule is multi-stage.

• Scenario: Remote Desktop Clipboard Sync Tool

  • Context: Administrators use tools like “RDP Clip” or “Clipboard Synchronizer” to maintain clipboard history across remote sessions. These tools often hook into the system clipboard and may read/write to temporary credential caches or local