ThreatFox: RevStealer IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the RevStealer malware by identifying known Indicators of Compromise (IOCs) that signal potential credential and data theft within the environment. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and contain early-stage infections, preventing lateral movement and sensitive data exfiltration before significant impact occurs.

IOC Summary

Malware Family: RevStealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["scheduler2.travel-scope.lol", "registry.lighttexture18.one"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: RevStealer IOCs detection rule:

• Scenario: A scheduled backup job utilizing Veeam Backup & Replication or Commvault is configured to scan a shared network drive that contains legacy documentation folders. These folders include archived PDFs and spreadsheets from third-party vendors which happen to contain file hashes matching the RevStealer IOCs (e.g., specific DLL names used in older vendor software).

  • Suggested Filter: Create an exclusion for the specific backup service account (e.g., DOMAIN\VeeamBackupSvc) and exclude the network path of the legacy documentation share (e.g., \\FileServer\LegacyDocs\*).

• Scenario: An administrator running a Microsoft Endpoint Configuration Manager (SCCM) or Intune deployment pushes a new software package to the “Finance” department. The installer package includes a dependency library (such as an older version of the .NET Framework or a specific Java Runtime) that is known to generate IOCs identical to RevStealer’s network beaconing behavior during the initial installation phase.

  • Suggested Filter: Exclude traffic originating from the SCCM/Intune management server IP range and filter out events where the parent process is ccmsetup.exe or Microsoft.IntuneManagementAgent.exe.

• Scenario: The enterprise utilizes a third-party RMM tool like Datto RMM or Kaseya VSA for patch management. During the nightly maintenance window, these agents perform a deep scan of user profiles to identify outdated software, triggering file creation events that match RevStealer’s specific registry key modifications and file hash signatures in the AppData directory.

  • Suggested Filter: Add an exclusion rule targeting the RMM agent process names (e.g., KaseyaAgent.exe,