ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt detects adversary behavior where Agent Tesla malware establishes persistence by capturing keystrokes and exfiltrating sensitive credentials following a successful phishing campaign involving malicious attachments or links. A proactive search in Azure Sentinel is critical to identify early-stage infections before attackers can compromise banking data or escalate privileges, thereby mitigating the high risk of widespread credential theft.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.darlenemarino.cyou", "ftp.melrz.com", "ftp.lodenrandmarines.com", "ftp.raxclopent.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

False Positive Scenarios: ThreatFox: Agent Tesla IOCs

• Scenario 1: Scheduled Backup and Reporting Tools

  • Context: Enterprise backup solutions or reporting agents often exfiltrate large volumes of structured data (including user credentials stored in logs) to cloud repositories over HTTPS, mimicking the exfiltration behavior of Agent Tesla.
  • Example: A scheduled job running Veeam Backup & Replication or Splunk Universal Forwarder transmitting credential logs to a central repository via port 443.
  • Filter/Exclusion: Exclude outbound traffic from known backup service accounts (e.g., svc_backup, splunk_forwarder) connecting to trusted internal IP ranges or specific cloud endpoints (e.g., *.veeam.com, *.splunkcloud.com).

• Scenario 2: Legitimate Phishing Simulation Platforms

  • Context: Security teams frequently use phishing simulation tools that send emails with attachments and links containing tracking pixels, which can trigger the “phishing email arrival” logic of the rule.
  • Example: A campaign launched via KnowBe4 (GoPhish) or Proofpoint Essentials where users click on simulated malicious links that redirect to a safe domain for landing page validation.
  • Filter/Exclusion: Create an allow-list for domains associated with the organization’s security awareness platform (e.g., *.knowbe4.com, *.proofpoint.com) and exclude traffic originating from these specific campaign IPs during active simulation windows.

• Scenario 3: Admin Remote Management Sessions

  • Context: System administrators performing routine maintenance often use remote desktop or management tools that capture keystrokes and session data, which can resemble the keylogging signature of Agent Tesla.
  • Example: An administrator using Microsoft System Center Configuration Manager (SCCM)