ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of SalatStealer malware by monitoring for specific indicators of compromise such as unique file hashes and network connections. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify early-stage credential theft and data exfiltration attempts before they escalate into broader organizational breaches.

IOC Summary

Malware Family: SalatStealer Total IOCs: 9 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`21a14766846449b8f7b65b2b680b936e87320385`	payload	2026-07-27	95%
md5_hash	`cffac6c24519fd656a99ddfe63611a27`	payload	2026-07-27	95%
sha256_hash	`ab4394c429efc69b6927a5eb6ecfe7e2cc3df99dd2d279f96729d72a8283e85f`	payload	2026-07-27	95%
sha256_hash	`a7c07b87c4968d7ac8120e2c6fb40ccd615d1bd25d4445fbe129d7c66235740a`	payload	2026-07-27	95%
sha1_hash	`26539d95c0c1a9b872469dab1e0d09ca54df9207`	payload	2026-07-27	95%
md5_hash	`f27c7e9e44efa74a367eff0200584d01`	payload	2026-07-27	95%
sha256_hash	`89d0178c292a0230d69c1de53f5e55994d195329cbbbacbaa7fb2e6101917b63`	payload	2026-07-27	95%
sha1_hash	`9ada72bf5ea6e4464cd63605a1ec4fdb69b28dbe`	payload	2026-07-27	95%
md5_hash	`b9974299de794e9b5e30ec95f7849e97`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["21a14766846449b8f7b65b2b680b936e87320385", "cffac6c24519fd656a99ddfe63611a27", "ab4394c429efc69b6927a5eb6ecfe7e2cc3df99dd2d279f96729d72a8283e85f", "a7c07b87c4968d7ac8120e2c6fb40ccd615d1bd25d4445fbe129d7c66235740a", "26539d95c0c1a9b872469dab1e0d09ca54df9207", "f27c7e9e44efa74a367eff0200584d01", "89d0178c292a0230d69c1de53f5e55994d195329cbbbacbaa7fb2e6101917b63", "9ada72bf5ea6e4464cd63605a1ec4fdb69b28dbe", "b9974299de794e9b5e30ec95f7849e97"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, including specific triggers and recommended exclusions:

Scenario 1: Automated Security Scanning by EDR Agents
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint perform regular scheduled scans that generate network traffic to known security vendor update servers. These scanners often query the exact IP addresses or domains associated with the SalatStealer IOCs as part of their threat intelligence feeds, mimicking the behavior of a stealer connecting to its command and control (C2) infrastructure.
- Suggested Filter: Exclude network traffic originating from the specific EDR service accounts (e.g., svc-crowdstrike or MsiDefender) where the destination port is restricted to standard update ports (443/80) and the source process hash matches the known signature of the security agent.
Scenario 2: Scheduled Backup Jobs Accessing Cloud Storage
- Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik execute nightly scheduled jobs that upload data to cloud repositories (e.g., AWS S3, Azure Blob). If the SalatStealer IOCs include generic cloud storage domains or IP ranges used by these providers, the backup agents’ routine connectivity will trigger the rule.
- Suggested Filter: Create an exclusion for processes named VeeamAgent.exe or rubrik-agent running on scheduled job windows (e.g., 01:00–05:00 UTC) connecting to specific cloud provider CIDR blocks that overlap with the IOCs.
Scenario 3: Admin Script Execution via PowerShell
- Context: System administrators frequently run custom PowerShell