ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior associated with the ACR Stealer malware, which actively exfiltrates sensitive credentials and data from Azure Container Registry environments. SOC teams should proactively hunt for these indicators in Azure Sentinel to rapidly contain potential breaches before attackers leverage stolen registry access to compromise broader cloud infrastructure.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["otp.vagrancyvirus.cc", "files.orchestratorlabs.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ACR Stealer IOCs detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated Backup Agent Scanning

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often scan user profile directories (including AppData) to capture configuration files and browser data. The ACR Stealer rule may flag these agents as they access known IOCs (specific file hashes or registry keys) associated with the stealer’s behavior within the backup scope.
  • Filter/Exclusion: Create an exclusion based on the process name and path. Exclude processes matching VeeamTransport.exe, vbrservice.exe, or CommServe.exe when they access paths under C:\Program Files\... or user profile directories, provided the parent process is a recognized service host (svchost.exe) with a valid digital signature from Veeam or Commvault.

• Scenario: Scheduled Browser Profile Migration

  • Context: IT administrators frequently run scheduled PowerShell scripts using Task Scheduler to migrate browser profiles (Chrome/Edge) during off-hours. These scripts often enumerate and copy specific registry keys and files that overlap with ACR Stealer’s IOCs, such as reading HKCU\Software\Google or accessing AppData\Local\Google.
  • Filter/Exclusion: Implement a filter to exclude events where the parent process is powershell.exe running under the context of a specific scheduled task (e.g., Task Name contains “Profile_Migration” or “Browser_Sync”). Additionally, verify that the script hash matches a known baseline hash stored in your SIEM’s asset inventory.

• Scenario: Endpoint Detection and Response (EDR) Health Checks

  • Context: EDR agents