ThreatFox: RevStealer IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the RevStealer malware, which targets sensitive data such as browser credentials and session tokens to facilitate account takeovers. A proactive hunt is essential within Azure Sentinel to rapidly identify compromised endpoints and extract stolen artifacts before attackers can leverage these credentials for lateral movement or financial fraud.

IOC Summary

Malware Family: RevStealer Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["route.ambergroup.one", "registry.evercircle.click", "config.cove-post.xyz"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: RevStealer IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Backup Agent Execution

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often execute scheduled jobs during off-hours that involve scanning user profile directories (e.g., C:\Users\*\AppData) to capture browser data and credentials. These agents may trigger network connections to external update servers or internal repositories that match RevStealer’s IOCs regarding file enumeration and exfiltration patterns.
  • Filter/Exclusion: Create a rule exclusion for the specific process paths of the backup agent (e.g., C:\Program Files\Veeam\Backup and Replication Service\...\Veeam.Backup.Service.exe) when they are running under the context of a dedicated service account (e.g., DOMAIN\svc_backup).

• Scenario: Endpoint Detection & Response (EDR) Health Checks

  • Context: EDR platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform regular health checks and telemetry collection. These agents frequently enumerate browser artifacts, registry keys related to authentication tokens, and network socket connections to verify agent integrity, which can mimic the file access and network behavior of RevStealer.
  • Filter/Exclusion: Exclude traffic and process activity originating from known EDR sensor processes (e.g., C:\Program Files\CrowdStrike\Falcon Sensor\csfalcon.exe) when the source user is a system account or the specific “Falcon Service” identity, specifically during their defined maintenance windows.

• Scenario: Identity Management & SSO Token Refresh

  • Context: In environments utilizing Okta, **Azure Active