ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Agent Tesla malware by matching network and endpoint telemetry against a curated set of twelve specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to identify early-stage infections that could lead to comprehensive credential theft, keylogging, and sensitive data exfiltration before lateral movement occurs.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 12 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["2b1f09c4559ffa9c0c4400d2bf96807e14243144c242b4d58d57af2fec004f18", "8ed2be4f406cd7012bbc432229c8938a97f02b5a", "0ac806ee073f53b035d805fac4f532fa", "e130fb44008595cc59028b23ee7c616e3c927a8ccdc03b0972a690e0378b0265", "34b80a1b8d157606d8f95929c59eb8844f693613", "1d4b4313f46c5e36636df5689a02eb2a", "74d740193b40387b0bb8d31d4e681146", "02469c593ecd42b98fd30db086bfc49c9a486d123085a626cf2ab247d7003e65", "b4cccb07fb11d53156e975edad2767ef519efc39", "4f1d4fda1144646990ce36efc915d43b", "5cae1bc499bb70c7bd93592360a9d6d5a4fefa3969feecb4c87553ddb582976d", "1c179c0c5b6d40186ee0599775f179817e65f4e4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate RMM Software Communication

  • Context: Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, NinjaOne, or SolarWinds N-Able often utilize similar telemetry patterns to Agent Tesla. Their agents frequently establish outbound HTTPS connections to cloud update servers using specific User-Agent strings that may overlap with the IOCs in the hunt package.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from known RMM service accounts (e.g., svc_rmm_update) or exclude the specific destination IP ranges of the RMM vendor’s update servers (e.g., *.manageengine.com, *.ninjamonkey.com). Additionally, filter out processes running under the C:\Program Files\ManageEngine\ directory path.

• Scenario: Scheduled Endpoint Backup Jobs

  • Context: Enterprise backup solutions such as Veeam Agent for Windows, Acronis Cyber Protect, or Rubrik often run scheduled jobs during off-hours that involve heavy file enumeration and network transmission. These agents may generate hash signatures or process behaviors (e.g., vss.exe, acronisbackupservice) that mimic the IOCs associated with Agent Tesla’s data exfiltration phase.
  • Filter/Exclusion: Implement a time-based exclusion window for backup windows (e.g., 01:00–05:00 local time) for processes matching known backup executable names (vss.exe, acronisbackupservice.exe). Alternatively, exclude events where the parent process is identified as the Windows Task Scheduler (svchost.exe with TaskScheduler service) triggering a specific task name