ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection identifies potential Agent Tesla malware infections by monitoring network and endpoint activity against three specific Indicators of Compromise (IOCs) known to facilitate remote access trojan behaviors. Proactively hunting for these signatures in Azure Sentinel is critical due to the high severity risk posed by Agent Tesla’s ability to exfiltrate sensitive credentials and keystrokes, which often go undetected until significant data loss occurs.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`015a1b2d4c10af211b9d400ca44c263d9badc960`	payload	2026-08-07	95%
md5_hash	`ed4ae654e0bbb7058128fef7bcad32a1`	payload	2026-08-07	95%
sha256_hash	`5067ae4261feea16e5b765d748a743eb9f55d86cf795c0213ac3769049e7dfba`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["015a1b2d4c10af211b9d400ca44c263d9badc960", "ed4ae654e0bbb7058128fef7bcad32a1", "5067ae4261feea16e5b765d748a743eb9f55d86cf795c0213ac3769049e7dfba"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

False Positive Scenarios for “ThreatFox: Agent Tesla IOCs” Rule

Scenario: Scheduled Backup or Monitoring Tools
- Context: Enterprise backup solutions like Veeam Backup & Replication or monitoring agents such as SolarWinds NPM often utilize telemetry mechanisms that match the specific file hashes or network signatures associated with Agent Tesla. These tools frequently run scheduled jobs during off-hours to collect system metrics, triggering the detection logic.
- Suggested Filter: Create an exclusion based on the ProcessName of known legitimate agents (e.g., VeeamService.exe, swagent.exe) and exclude events where the ParentProcessName is a scheduled task runner (svchost.exe or TaskScheduler.exe) running during defined maintenance windows.
Scenario: IT Asset Inventory Scans
- Context: Automated inventory tools such as Landesk, SCCM (Microsoft Endpoint Configuration Manager), or ServiceNow Discovery periodically scan endpoints to gather hardware and software configuration data. These scans often involve file hashing and network traffic patterns that overlap with the IOCs defined for Agent Tesla, particularly when scanning remote offices over WAN links.
- Suggested Filter: Implement a filter that excludes alerts originating from specific IP ranges dedicated to management servers (e.g., 10.x.x.x subnet) or adds an exclusion rule where the CommandLine contains keywords like “inventory”, “discovery”, or “asset collection”.
Scenario: Third-Party Security Suite Updates
- Context: Endpoint Detection and Response (EDR) platforms like CrowdStrike Falcon, SentinelOne, or Carbon Black often update their local agents or perform deep system introspection. During these update cycles, the EDR agent may spawn child processes that mimic the behavior of Agent Tesla, specifically regarding registry key modifications