This hunt identifies the presence of 58 known indicators of compromise associated with the ACR Stealer, a tool frequently used by threat actors to exfiltrate sensitive data and credentials from compromised Azure environments. Proactively hunting for these IOCs allows the SOC to detect stealthy persistence or data exfiltration attempts before they escalate into a full breach, ensuring rapid containment of high-severity threats.
Malware Family: ACR Stealer Total IOCs: 58 IOC Types: domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | honeytrail.cc | botnet_cc | 2026-09-26 | 100% |
| domain | russetmoor.cc | botnet_cc | 2026-09-26 | 100% |
| domain | apricotrun.cc | botnet_cc | 2026-09-26 | 100% |
| domain | quiverlake.cc | botnet_cc | 2026-09-26 | 100% |
| domain | junebrook.cc | botnet_cc | 2026-09-26 | 75% |
| domain | kelpstone.cc | botnet_cc | 2026-09-26 | 75% |
| domain | kestrelbay.cc | botnet_cc | 2026-09-26 | 75% |
| domain | kilogramwomanlike.cc | botnet_cc | 2026-09-26 | 75% |
| domain | koalafield.cc | botnet_cc | 2026-09-26 | 75% |
| domain | linenwood.cc | botnet_cc | 2026-09-26 | 75% |
| domain | logicbyte.cc | botnet_cc | 2026-09-26 | 75% |
| domain | lowenbay.cc | botnet_cc | 2026-09-26 | 75% |
| domain | peddlingconjure.cc | botnet_cc | 2026-09-26 | 75% |
| domain | swiftflux.cc | botnet_cc | 2026-09-26 | 75% |
| domain | webforq.cc | botnet_cc | 2026-09-26 | 75% |
| domain | wisebyte.cc | botnet_cc | 2026-09-26 | 75% |
| domain | bramblefox.cc | botnet_cc | 2026-09-26 | 75% |
| domain | brightloop.cc | botnet_cc | 2026-09-26 | 75% |
| domain | buildcraft.cc | botnet_cc | 2026-09-26 | 75% |
| domain | byteforj.cc | botnet_cc | 2026-09-26 | 75% |
| domain | bytestream.cc | botnet_cc | 2026-09-26 | 75% |
| domain | bytestreem.cc | botnet_cc | 2026-09-26 | 75% |
| domain | cachehub.cc | botnet_cc | 2026-09-26 | 75% |
| domain | cachenest.cc | botnet_cc | 2026-09-26 | 75% |
| domain | cinderlake.cc | botnet_cc | 2026-09-26 | 75% |
// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["honeytrail.cc", "russetmoor.cc", "apricotrun.cc", "quiverlake.cc", "junebrook.cc", "kelpstone.cc", "kestrelbay.cc", "kilogramwomanlike.cc", "koalafield.cc", "linenwood.cc", "logicbyte.cc", "lowenbay.cc", "peddlingconjure.cc", "swiftflux.cc", "webforq.cc", "wisebyte.cc", "bramblefox.cc", "brightloop.cc", "buildcraft.cc", "byteforj.cc", "bytestream.cc", "bytestreem.cc", "cachehub.cc", "cachenest.cc", "cinderlake.cc", "clearflux.cc", "cleverstack.cc", "cloudbite.cc", "cloudbyt.cc", "compilehub.cc", "dovewick.cc", "duskmoor.cc", "eaglehurst.cc", "elmquarry.cc", "foxglade.cc", "frostmere.cc", "garnetmill.cc", "gingerfall.cc", "glenmere.cc", "gridnest.cc", "hemlockbay.cc", "hexforge.cc", "humiliatepreseason.cc", "indigowell.cc", "irispoint.cc", "acornvista.cc", "aldercove.cc", "basilcrest.cc", "boldforge.cc", "eee48.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
DnsEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Azure DevOps) to deploy a custom container image to an Azure Container Registry (ACR) instance. The pipeline script may temporarily store authentication tokens or use specific API endpoints that match the IOCs for registry access or credential retrieval.
agent.exe, runner.exe, or docker.exe) and the destination is an internal ACR endpoint (*.azurecr.io) or the source IP is within the corporate CI/CD subnet.Scenario: An application team performs a routine “pull” of a base image (e.g., nginx, node, or python) from a public or private ACR repository during a local development or testing phase. The ACR Stealer often targets registry credentials, so legitimate docker pull or crictl pull commands interacting with ACR endpoints may trigger IOCs related to registry API calls or credential file access.
pull, login, tag) and the process is a container runtime (dockerd, containerd, crio) or a standard CLI tool (docker, skopeo, crane), provided the user account is a service account or developer group member.Scenario: A security or compliance team runs a scheduled vulnerability scan or asset inventory job (e.g., using tools like Trivy, Grype, or Azure Container Registry audit scripts) that enumerates images in the ACR. These tools often make read-only API calls to list repositories and tags, which can match IOCs for reconnaissance or credential harvesting patterns.