ThreatFox: Phantom Stealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior where endpoints interact with known indicators of compromise (IOCs) linked to the Phantom Stealer malware, which targets sensitive credentials and financial data through stealthy infection vectors. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before they escalate into broader credential theft or lateral movement incidents within the organization’s cloud infrastructure.

IOC Summary

Malware Family: Phantom Stealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`c67f0473eae2e790676584b108e7ed73`	payload	2026-08-04	95%
sha256_hash	`c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31`	payload	2026-08-04	95%
sha1_hash	`b14b5b72fb8314c14c5fa5e9046802b4202f3175`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Phantom Stealer
let malicious_hashes = dynamic(["c67f0473eae2e790676584b108e7ed73", "c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31", "b14b5b72fb8314c14c5fa5e9046802b4202f3175"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Phantom Stealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Phantom Stealer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Security Scanning by Endpoint Protection Agents
- Context: Enterprise EDR solutions (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) frequently perform scheduled deep scans or real-time file monitoring. When these agents scan the network share or specific application directories containing known Phantom Stealer signatures in their local definition databases, they may generate IOCs matching the rule’s logic even though no actual infection is occurring on the host.
- Filter/Exclusion: Create a filter to exclude events where the Process_Name matches known security agents (e.g., MsMpEng.exe, FalconSensorService.exe) and the User_Account is a system service account (e.g., NT SERVICE\Microsoft Antimalware). Additionally, exclude traffic originating from internal IP ranges dedicated to Security Operations Centers.
Scenario: Scheduled Backup Jobs Accessing Stealer-Related Artifacts
- Context: Enterprise backup solutions like Veeam or Commvault often run scheduled jobs that access browser profiles (Chrome/Edge) and credential stores to archive user data. Since Phantom Stealer targets these exact artifacts, the backup process reading files with similar hashes or accessing specific registry keys can trigger the detection logic as a potential stealer activity.
- Filter/Exclusion: Exclude events where the Parent_Process_Name is identified as a backup service (e.g., VeeamService.exe, vssvc.exe) and the action occurs during defined maintenance windows (e.g., 02:00–04:00 UTC). A specific exclusion rule can be applied to the File_Hash if it matches known backup artifact signatures.
**Scenario: Admin Deployment of