ThreatFox: ACR Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors deploy the ACR Stealer malware to exfiltrate sensitive data from Azure Container Registries using known indicators of compromise. Proactive hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify and contain potential registry breaches before attackers can leverage stolen credentials or artifacts to move laterally within the cloud environment.

IOC Summary

Malware Family: ACR Stealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ACR Stealer
let malicious_domains = dynamic(["wss.infrastructurecore.cc", "infrastructurecore.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — ACR Stealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ACR Stealer IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Scripts Executing Known Hashes

  • Context: Enterprise backup solutions like Veeam or Rubrik often run scheduled PowerShell scripts that download configuration manifests or agent updates from internal repositories. If the ACR Stealer IOCs include specific file hashes or URLs that match these legitimate repository artifacts, the rule will trigger on every backup cycle.
  • Filter/Exclusion: Create a filter to exclude alerts where the ProcessName is Veeam.Backup.Service.exe (or similar vendor binaries) and the ParentProcessName is TaskSchedulerService. Alternatively, add the specific file hashes of the known backup artifacts to the detection rule’s exclusion list.

• Scenario: Endpoint Protection Agent Self-Updates

  • Context: Security suites such as CrowdStrike Falcon, Microsoft Defender for Endpoint (MDE), or SentinelOne frequently perform background self-updates by downloading new definition packs from their cloud portals. If the ACR Stealer IOCs overlap with the update server domains or installer hashes used by these agents, legitimate update events will be flagged as potential stealer activity.
  • Filter/Exclusion: Implement a rule exclusion based on ProcessImage containing keywords like “FalconSensor”, “MsMpEng.exe”, or “SentinelOneAgent”. Additionally, filter out events where the NetworkDestination is the vendor’s official update domain (e.g., *.crowdstrike.com, *.microsoft.com).

• Scenario: DevOps CI/CD Pipeline Artifacts

  • Context: In environments using Jenkins, GitLab Runners, or **Azure Dev