This hunt targets the presence of SalatStealer, a data-stealing malware that exfiltrates sensitive information such as credentials and browser data, by correlating known IOCs against Azure Sentinel telemetry. Proactively hunting for this threat is critical because its ability to harvest high-value assets enables persistent access and lateral movement, making early detection essential to mitigate the risk of significant data breaches.
This hunt targets the presence of SalatStealer, a data-stealing malware that exfiltrates sensitive information such as credentials and browser data, by correlating known IOCs against Azure Sentinel telemetry. Proactively hunting for this threat is critical because its ability to harvest high-value assets enables persistent access and lateral movement, making early detection essential to mitigate the risk of significant data breaches.
Malware Family: SalatStealer Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | f4089636155d036a336ea97e338ae1cc01928981c64d1c7eb3127f141b08e736 | payload | 2026-09-26 | 95% |
| sha1_hash | 0b354d5c9070b4b054554bd176ebccc98d358ab4 | payload | 2026-09-26 | 95% |
| md5_hash | a9b602b3aa1ecfdff14a609096451f19 | payload | 2026-09-26 | 95% |
| sha256_hash | e3a5b8e3adb395bca58d008c96319acc9834dceded5db722bfb32fd816fc3872 | payload | 2026-09-26 | 95% |
| sha1_hash | bf9779193f1593d73bf9d2e89bc4a5f054c21918 | payload | 2026-09-26 | 95% |
| md5_hash | d7705e14d5ed13c8e628d051ff13fc7c | payload | 2026-09-26 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["f4089636155d036a336ea97e338ae1cc01928981c64d1c7eb3127f141b08e736", "0b354d5c9070b4b054554bd176ebccc98d358ab4", "a9b602b3aa1ecfdff14a609096451f19", "e3a5b8e3adb395bca58d008c96319acc9834dceded5db722bfb32fd816fc3872", "bf9779193f1593d73bf9d2e89bc4a5f054c21918", "d7705e14d5ed13c8e628d051ff13fc7c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Browser Extension Updates via IT Management Tools: Enterprise endpoint management tools like Microsoft Intune or Jamf Pro often push updates to browser extensions (e.g., 1Password, LastPass, or corporate SSO plugins) which may involve writing to local storage files or modifying Local State/Cookies databases in the user profile. This can mimic the file access patterns of SalatStealer.
IntuneAgent.exe, jamfproagent, ccmexec.exe) and the target path is within a standard browser profile directory (e.g., C:\Users\<user>\AppData\Local\Google\Chrome\User Data\).Scheduled Credential Sync Jobs by Identity Providers: Services like Okta, Azure AD Connect, or Ping Identity agents run scheduled tasks to synchronize directory services and may read local credential stores or browser token caches to maintain session consistency or debug authentication flows.
msiexec.exe running Okta setup, adwsc.exe for Azure AD Connect) and the action is a read operation on files named Login Data, Cookies, or Web Data within browser profile directories.Endpoint DLP Scanning of User Profiles: Data Loss Prevention (DLP) solutions such as Symantec DLP, Forcepoint, or Netskope actively scan user profile directories, including AppData\Local, to detect sensitive data like passwords or tokens stored in browser caches. This involves opening and reading files that SalatStealer typically targets.