ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt detects the presence of Agent Tesla malware, which compromises systems by injecting keylogging capabilities into browser processes to exfiltrate credentials and clipboard data following a successful phishing campaign. Proactive hunting in Azure Sentinel is critical because early identification of these specific IOCs allows the SOC team to isolate affected endpoints before sensitive authentication tokens and keystrokes are fully harvested by the adversary.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`fb26fdde000d289ac423f5dd74865e43`	payload	2026-07-25	95%
sha256_hash	`51816d9ac510766a54a0cc31569c5fd97b46742e0de82f18854ea042bfdfdf7b`	payload	2026-07-25	95%
sha1_hash	`546a20ebd21328f86293ac94bc59b00a5c6f8426`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["fb26fdde000d289ac423f5dd74865e43", "51816d9ac510766a54a0cc31569c5fd97b46742e0de82f18854ea042bfdfdf7b", "546a20ebd21328f86293ac94bc59b00a5c6f8426"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

False Positive Scenarios for “ThreatFox: Agent Tesla IOCs” Rule

Scenario 1: Legitimate Browser Extension Installation
- Context: Enterprise users frequently install productivity or security extensions (e.g., LastPass, 1Password, or Microsoft Authenticator) that inject scripts into browser processes to capture credentials or manage clipboard data. These legitimate tools often mimic the behavioral signature of Agent Tesla by hooking into chrome.exe or msedge.exe.
- Suggested Filter/Exclusion: Create a whitelist exclusion for known benign extension publishers and specific registry keys associated with these tools (e.g., filter out processes where CommandLine contains “LastPass” or “Authenticator” and the parent process is a trusted browser).
Scenario 2: Scheduled Clipboard Monitoring via PowerShell
- Context: IT administrators often deploy scheduled jobs using PowerShell scripts to audit clipboard content for compliance or to automate data entry tasks. These scripts may spawn child processes that monitor clip.exe or interact with the Windows clipboard API, triggering the rule’s detection of “clipboard content theft.”
- Suggested Filter/Exclusion: Exclude alerts where the parent process is powershell.exe running under a specific service account (e.g., DOMAIN\IT-Admin) and the script path matches known internal automation directories (e.g., C:\Scripts\Compliance\).
Scenario 3: RMM Tool Agent Updates
- Context: Remote Monitoring and Management tools like ManageEngine Desktop Central, SolarWinds NCM, or Kaseya VSA perform routine health checks that involve injecting agents into browser processes to verify user activity or capture session logs. During these updates, the RMM agent may exhibit keylogging behaviors similar to Agent Tesla.
- Suggested Filter/Exclusion: