ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection rule identifies Agent Tesla keylogger activity by monitoring encrypted command-and-control communications associated with known phishing vectors that exfiltrate credentials and keystrokes. Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly detect early-stage data theft and prevent lateral movement before sensitive information is compromised.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Agent Tesla
let malicious_ips = dynamic(["68.65.123.172"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["68.65.123.172"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.ulfl.co.in"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Desktop Administration via Known C2 Infrastructure

  • Context: Enterprise IT administrators frequently use remote management tools (e.g., Microsoft System Center Configuration Manager, Ivanti Neurons, or TeamViewer) to deploy patches and manage endpoints. These tools often establish encrypted outbound connections to known cloud-based command-and-control servers that share IP ranges or port usage patterns similar to Agent Tesla’s C2 channels.
  • Suggested Filter/Exclusion: Create an exclusion for traffic originating from the “IT Operations” OU (Organizational Unit) where the destination IP belongs to the vendor’s trusted CIDR block. Additionally, filter out connections using specific high-numbered ephemeral ports if the source process is ccmexec.exe or ivanti-agent.exe.

• Scenario: Scheduled Backup Jobs Utilizing Encrypted Channels

  • Context: Automated backup solutions (e.g., Veeam Agent for Windows, Rubrik, or Acronis Cyber Protect) run on a scheduled basis to exfiltrate data to cloud repositories. These agents often use encrypted channels and specific domains that may overlap with the IOCs defined in the ThreatFox rule, triggering alerts when large volumes of keystroke-like metadata or credential logs are transmitted during backup windows.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for these processes (e.g., vrb.exe or AcronisBackupService) running between 01:00 and 06:00 local time on weekdays. Alternatively, whitelist the specific backup destination domains if they are verified as non-malicious in the threat intelligence feed.

• **Scenario: Phishing Simulation Campaigns