ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hunt hypothesis detects Agent Tesla keylogger activity by identifying encrypted command-and-control communications and anomalous data exfiltration patterns resulting from phishing-driven initial access. Proactive hunting for these indicators in Azure Sentinel is critical to rapidly identify credential theft and keystroke capture before adversaries can leverage stolen sensitive data for lateral movement or further compromise.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.zetrocom.my", "mail.voestelpine.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule, along with recommended filters and exclusions:

• Scenario: Legitimate Phishing Simulation Campaigns

  • Context: Security teams frequently use tools like Proofpoint, KnowBe4, or GoPhish to run internal phishing simulations. These campaigns often distribute emails containing attachments (e.g., PDFs, Word docs) that mimic real-world attack vectors and may connect to simulation C2 servers that resemble Agent Tesla’s communication patterns.
  • Filter/Exclusion: Exclude traffic originating from the specific IP ranges of your security awareness platform or filter alerts where the source process is GoPhish.exe, ProofpointAgent.exe, or KnowBe4Client.exe. Additionally, whitelist known simulation domains (e.g., *.phishing-sim.com) in the detection logic.

• Scenario: Scheduled Remote Backup and Monitoring Jobs

  • Context: Enterprise environments rely on scheduled tasks for data exfiltration to cloud storage or monitoring dashboards. Tools like Veeam, Carbonite, or Datadog agents often establish encrypted connections to external servers at regular intervals, which can trigger the “unexpected data exfiltration” logic of the rule.
  • Filter/Exclusion: Create an exclusion for processes running under scheduled tasks (e.g., VeeamTransport.exe, CarboniteAgent.exe) that connect to known backup domains. Implement a time-based filter to suppress alerts during defined maintenance windows where these jobs are active.

• Scenario: Admin-Initiated Credential Harvesting via RMM Tools

  • Context: System administrators often use Remote Monitoring and Management (RMM) tools like ManageEngine, NinjaOne, or PDQ Deploy to push updates, collect logs, or remotely