ThreatFox: RevStealer IOCs

Hunt Hypothesis

This detection rule identifies the presence of known indicators of compromise (IOCs) linked to the RevStealer infostealer, which targets sensitive credentials and financial data from compromised endpoints. Proactive hunting for these IOCs within Azure Sentinel is critical to rapidly contain active infections before adversaries can exfiltrate high-value secrets or establish persistent access for future attacks.

IOC Summary

Malware Family: RevStealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["upload.frame-quest.lol", "resolve.mint-screen.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: RevStealer IOCs detection rule:

• Legitimate Scenario: A System Administrator runs a scheduled PowerShell script (Update-RevStealerConfig.ps1) on the domain controller to push configuration updates. The script explicitly queries the ThreatFox API endpoint or downloads a CSV feed containing RevStealer indicators, triggering network traffic and file access events that match the rule’s IOCs.

  • Suggested Filter: Exclude traffic originating from specific trusted IP addresses (e.g., 10.20.5.15 - Domain Controller) where the process name is powershell.exe and the command line contains the keyword Update-RevStealerConfig.

• Legitimate Scenario: The enterprise Endpoint Detection and Response (EDR) agent, specifically CrowdStrike Falcon, performs a daily telemetry sync. During this synchronization, the agent’s background service (FalconSensorService) communicates with an internal Threat Intelligence platform that hosts RevStealer signatures, generating network connections to known IOCs defined in the rule.

  • Suggested Filter: Create an exclusion for processes named falconcontainer.exe or FalconSensorService when communicating with the internal threat intelligence domain (e.g., threat-intel.corp.local) during business hours (08:00–18:00).

• Legitimate Scenario: A DevOps team utilizes Ansible to deploy a new security policy across the web server farm. The deployment playbook includes a step that downloads and validates a specific RevStealer signature file from an internal artifact repository, causing the ansible-runner process to generate network requests matching the detection logic.

  • Suggested Filter: Exclude events where the parent process is ansible-runner.exe or python.exe running under the service account svc-devops, provided