ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection rule identifies potential Agent Tesla malware infections by monitoring for specific Indicators of Compromise (IOCs) known to facilitate remote access and data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints before adversaries can establish persistence or steal sensitive credentials across the enterprise network.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Agent Tesla
let malicious_ips = dynamic(["195.250.27.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["195.250.27.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["mail.outlook-office365.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

False Positive Scenarios: ThreatFox: Agent Tesla IOCs

• Scheduled Backup Job Execution

  • Scenario: The enterprise backup solution, Veeam Backup & Replication, runs a nightly job that extracts compressed archives containing the AgentTesla folder structure from legacy client images. This process triggers file creation events matching the rule’s hash signatures for legitimate backup artifacts rather than malicious infection.
  • Filter/Exclusion: Exclude processes spawned by Veeam.Backup.Service.exe and any file paths located within the dedicated backup repository directory (e.g., \\BackupServer\Repos\Veeam\).

• Endpoint Security Scanning

  • Scenario: The organization’s EDR solution, CrowdStrike Falcon, performs a deep heuristic scan on user workstations. During this scan, the agent creates temporary quarantine files or logs that coincidentally match the IOCs (specifically file hashes) defined in the Agent Tesla detection logic, causing a spike in alerts during peak maintenance windows.
  • Filter/Exclusion: Add an exclusion for process names CrdSvc.exe and FalconSensorService.exe, specifically when they are operating within the C:\ProgramData\CrowdStrike\ directory tree.

• Software Deployment via Configuration Management

  • Scenario: The IT Operations team utilizes Microsoft SCCM (Configuration Manager) to deploy a new security utility package named “AgentTesla-Monitor” to the Finance department. The deployment agent extracts installation files that match the rule’s IOCs, generating alerts as if a new threat were being installed on every targeted machine.
  • Filter/Exclusion: Create a logic filter to suppress alerts where the parent process is ccmsetup.exe or WUAHandler.exe and the file path contains \SoftwareDistribution\ or \CCMCache\.