ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of SalatStealer malware by identifying known indicators of compromise such as specific file hashes and network connections within the Azure Sentinel environment. Proactive hunting for these IOCs is critical to rapidly identify and contain active credential theft campaigns before they escalate into broader data exfiltration incidents.

IOC Summary

Malware Family: SalatStealer Total IOCs: 8 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["266f2cfe9aecf638c06b3efcbdd07756", "dd17e871204619a3de34126e366221b64e684ec13e24dfc871698abe343acbff", "2dab1463c97284de02f3abb10812c45eed5fe6b8", "d3d7deaac01485bff55d6e6d1553bbcfaa45554f", "6ab8540db2cc96cd482583c84b2bac2a", "615a472ec89ed0f34c7c4a51131e19ee154b2e49d70bf51f04119de521c05d48", "f0c95addd0f6d77d8ada755ce186b66515344f46", "4ba88b5790e327ce805843417d2708c5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SalatStealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Endpoint Protection Scanning of Quarantine Directories

  • Scenario: The primary security suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled deep scan of the C:\ProgramData\Quarantine directory. Since SalatStealer often targets browser profiles and credential stores, the scanner’s hash comparison logic may match against known IOCs stored within the quarantine folder itself, triggering an alert when the tool simply reads its own database or logs.
  • Suggested Filter: Exclude alerts where the Process Name is MsMpEng.exe, FalconSensorService.exe, or WdFilter.sys and the File Path contains \Quarantine\ or \Logs\.

• Automated Browser Profile Backup Jobs

  • Scenario: A scheduled Task (e.g., via Windows Task Scheduler) runs nightly to back up user browser profiles (%APPDATA%\Microsoft\Edge, %LOCALAPPDATA%\Google\Chrome) to a network share. SalatStealer IOCs often include specific registry keys or file hashes related to these browsers. The backup agent (such as Veeam Agent or Acronis Cyber Protect) accessing these specific paths to archive them may trigger the rule.
  • Suggested Filter: Create an exclusion for Process Name matching VeeamAgent.exe, AcronisCyberProtect.exe, or robocopy.exe when the Target Path matches standard browser profile directories (e.g., *\Microsoft\Edge\User Data, *\Google\Chrome\User Data).

• IT Admin Credential Harvesting via PowerShell

  • Scenario: An IT administrator executes a custom PowerShell