ThreatFox: RevStealer IOCs

Hunt Hypothesis

This rule detects adversaries leveraging the RevStealer infostealer to exfiltrate sensitive credentials and browser data from compromised endpoints within the Azure Sentinel environment. Proactive hunting for these indicators is critical because RevStealer’s ability to silently harvest stored authentication tokens can lead to rapid lateral movement and persistent unauthorized access if not immediately identified and contained.

IOC Summary

Malware Family: RevStealer Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - RevStealer
let malicious_domains = dynamic(["index.ridgefield.lol", "task.pantryly83.one"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — RevStealer

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: RevStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Backup Jobs Accessing Credential Stores

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Commvault often run scheduled jobs that access the C:\ProgramData\Microsoft\User Experience directory or specific registry keys to capture user state and credential data. These processes may match RevStealer’s behavior of reading credential stores (e.g., vss.exe, Veeam.Backup.Service.exe).
  • Filter/Exclusion: Create an exclusion for the process image path matching known backup service executables (e.g., *Veeam.Backup.Service.exe, *Rubrik.Agent.exe) and restrict the rule to exclude network traffic originating from the “Backup” security group or specific backup server FQDNs.

• Scenario: Endpoint Detection & Response (EDR) Agent Telemetry

  • Context: EDR agents such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform continuous scanning and telemetry collection. Their background processes often enumerate running processes, read registry keys related to user sessions, and access browser profile directories (AppData\Local\Google, Mozilla, etc.), which mimics the reconnaissance phase of RevStealer.
  • Filter/Exclusion: Exclude process hashes belonging to trusted EDR agents (e.g., falcon.sys or MsMpEng.exe) from triggering this rule. Additionally, filter out events where the parent process is a known system service like svchost.exe with the specific service name Wuauserv or DefenderSvc.

• **Scenario: IT Admin Performing Credential Audits via PowerShell