ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hypothesis targets the presence of Agent Tesla, a keylogger that exfiltrates credentials and keystrokes through covert command-and-control channels, often deployed via phishing or exploit kits. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the theft of sensitive data and lateral movement before the adversary achieves their objectives.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 9 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80`	payload	2026-09-21	95%
sha1_hash	`c5dfb45b76144ce20870bbdd5defb0a51989e0bb`	payload	2026-09-21	95%
md5_hash	`9a3d0e61430550fc5f788c7cef6c1644`	payload	2026-09-21	95%
sha1_hash	`2478f36bdc0cc9c4e7cdd1da2fc22dca7e98e78b`	payload	2026-09-21	95%
md5_hash	`6214f3fcc00cd747d244f0e2ab635618`	payload	2026-09-21	95%
sha256_hash	`c65486c9a6e7ad11cf87ed332d09a70e613ec18805851609b6abde5b618a479c`	payload	2026-09-21	95%
sha1_hash	`04f1b1bd076950dbfacb762fcce73588ed4c0556`	payload	2026-09-21	95%
md5_hash	`5395d02944c8a772316499b75d62a25e`	payload	2026-09-21	95%
sha256_hash	`cd779076639126e20c3a7f2db656f376977953493fa33cc1ac232c4631f19810`	payload	2026-09-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["89c1a2c27470e898513e95d6175c382cd5a33fd6a509cde700b213214ecf0b80", "c5dfb45b76144ce20870bbdd5defb0a51989e0bb", "9a3d0e61430550fc5f788c7cef6c1644", "2478f36bdc0cc9c4e7cdd1da2fc22dca7e98e78b", "6214f3fcc00cd747d244f0e2ab635618", "c65486c9a6e7ad11cf87ed332d09a70e613ec18805851609b6abde5b618a479c", "04f1b1bd076950dbfacb762fcce73588ed4c0556", "5395d02944c8a772316499b75d62a25e", "cd779076639126e20c3a7f2db656f376977953493fa33cc1ac232c4631f19810"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

IT Helpdesk Remote Support Sessions: Agents using remote control tools like TeamViewer, AnyDesk, or VNC to troubleshoot user issues may generate high-volume network connections or process injections that mimic C2 beaconing. Filter: Exclude processes spawned by known remote support executables (e.g., TeamViewer.exe, AnyDesk.exe) or exclude network connections to known IT infrastructure IP ranges during business hours.
Browser Extension Updates and Sync: Modern browsers (Chrome, Edge, Firefox) and their extensions (e.g., 1Password, LastPass, Grammarly) frequently establish outbound HTTPS connections to sync data or update, which can be misidentified as data exfiltration if the rule relies on generic “browser cookie” or “high-volume outbound traffic” triggers. Filter: Exclude processes named chrome.exe, msedge.exe, firefox.exe, and their child processes, or exclude connections to known CDN and SaaS endpoints (e.g., *.cloudfront.net, *.googleapis.com).
Software Deployment and Patch Management: Scheduled tasks or GPOs running software installers (e.g., msiexec.exe, setup.exe) or patch management agents (e.g., SCCM, WSUS clients) may download large payloads or establish persistent connections to internal repositories, triggering IOCs related to “malicious attachments” or “covert communication.” Filter: Exclude processes associated with standard Windows deployment tools (msiexec.exe, wuaexer.exe) and exclude network connections to internal patch management server IPs or domains.
Development and Testing Environments: Developers running local web servers, API testing tools (Postman, Insomnia), or containerized applications (Docker, Kubernetes) may generate frequent outbound connections or process injections that resemble keylogger C2 behavior. Filter: Exclude processes associated with development tools (node.exe, python.exe, java.exe, `