ThreatFox: Lumma Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known Lumma Stealer indicators to identify active credential and data theft campaigns within the Azure Sentinel environment. Proactively hunting for these specific IOCs is critical because early detection allows the SOC team to rapidly isolate compromised endpoints before attackers can exfiltrate sensitive credentials or deploy additional malware payloads.

IOC Summary

Malware Family: Lumma Stealer Total IOCs: 2 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Lumma Stealer
let malicious_domains = dynamic(["ntds.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Lumma Stealer
let malicious_urls = dynamic(["https://ntds.shop/jsrepo"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Lumma Stealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Lumma Stealer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus or Endpoint Protection Updates

  • Context: Enterprise endpoints often run scheduled updates for security agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) that download definition packs containing hashes matching Lumma Stealer IOCs. These updates may temporarily generate network traffic or file artifacts flagged by the rule.
  • Filter/Exclusion: Create a filter to exclude processes originating from known security vendor executables (e.g., C:\Program Files\CrowdStrike\fsq.exe, MsMpEng.exe) and restrict the alert scope to non-business hours if updates are scheduled for off-peak times.

• Scenario: IT Admin Deployment of Patch Management Tools

  • Context: System administrators frequently use tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Intune to deploy patches and software packages. The installation agents often download temporary installer files or scripts from internal repositories that may share file hashes with Lumma Stealer IOCs during the deployment phase.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, and add a condition to ignore events occurring within 15 minutes of a known “Patch Tuesday” deployment window.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Enterprise backup solutions such as Veeam, Rubrik, or Commvault run nightly jobs that archive user data to storage repositories. These tools often utilize compression algorithms or temporary staging files that generate IOCs similar to the Lumma Stealer signatures, particularly when processing large volumes of user documents.