ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior where Stealc malware, often introduced via phishing campaigns, establishes encrypted command-and-control channels to exfiltrate sensitive browser credentials and passwords. A SOC team should proactively hunt for this in Azure Sentinel because early identification of these specific IOCs allows for rapid containment before attackers compromise critical identity assets and escalate their access within the environment.

IOC Summary

Malware Family: Stealc Total IOCs: 9 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`594c0f31ddffd8007e579d3757a7e93482b67ca7`	payload	2026-08-07	95%
md5_hash	`3082ed63bb7d87f051c6a167d371b20b`	payload	2026-08-07	95%
sha256_hash	`212199a413252df5ad9be87d8070083d74a9f3e7919b3c005db2ed7fe6793343`	payload	2026-08-07	95%
sha1_hash	`f8f6dc9dd47c48a9e3ab66cf07bea628e4c06b34`	payload	2026-08-07	95%
md5_hash	`6d3ec0d0e31dc8d2e52d545f317a88fa`	payload	2026-08-07	95%
sha256_hash	`5c113804b804fb934afe84965e69a2bd912cef31203b2e4f367d8986b8783c93`	payload	2026-08-07	95%
sha256_hash	`652f91bcf60dc148e7af64bf509cd4f7e4ffac685030bc260c59c7b869585ac9`	payload	2026-08-07	95%
sha1_hash	`7c43762eb07a44ba9add9301546b77e4e6d5bfa7`	payload	2026-08-07	95%
md5_hash	`e79ad54bd794375224a5d76d56f3180b`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Stealc
let malicious_hashes = dynamic(["594c0f31ddffd8007e579d3757a7e93482b67ca7", "3082ed63bb7d87f051c6a167d371b20b", "212199a413252df5ad9be87d8070083d74a9f3e7919b3c005db2ed7fe6793343", "f8f6dc9dd47c48a9e3ab66cf07bea628e4c06b34", "6d3ec0d0e31dc8d2e52d545f317a88fa", "5c113804b804fb934afe84965e69a2bd912cef31203b2e4f367d8986b8783c93", "652f91bcf60dc148e7af64bf509cd4f7e4ffac685030bc260c59c7b869585ac9", "7c43762eb07a44ba9add9301546b77e4e6d5bfa7", "e79ad54bd794375224a5d76d56f3180b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule, along with suggested filters or exclusions:

Scenario: Scheduled Browser Credential Backup via Enterprise Management Tools
- Context: End-users or IT administrators running scheduled backups of browser profiles (e.g., Chrome/Edge) using tools like Microsoft Endpoint Configuration Manager (ConfigMgr) or Jamf Pro. These processes often trigger network connections to internal backup repositories that match the encrypted communication patterns of Stealc’s C2 channels.
- Filter/Exclusion: Exclude traffic originating from specific management service accounts (e.g., DOMAIN\BackupSvc) connecting to known internal IP ranges used for data archiving, specifically filtering out ports associated with backup protocols (e.g., 443, 8080) that do not match the external C2 domain list.
Scenario: Automated Phishing Simulation and Training Platforms
- Context: Security teams utilizing platforms like KnowBe4, Proofpoint, or Coveware to conduct phishing simulations. These tools often deploy simulated “credential harvesting” pages that mimic the exact encrypted traffic signatures of Stealc, causing the detection engine to flag legitimate training traffic as a potential malware infection.
- Filter/Exclusion: Create an allow-list for the specific domain names and IP ranges associated with the organization’s designated phishing simulation vendor (e.g., *.knowbe4.com, *.proofpoint.com) within the rule logic, ensuring traffic from these sources is bypassed regardless of payload similarity.
Scenario: Legitimate Admin Tasks Involving Remote Credential Syncing
- Context: System administrators performing routine maintenance using Microsoft Active Directory Federation Services (ADFS) or Azure AD Connect to sync user credentials and passwords between on-premise directories and cloud environments. The encrypted