ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies active indicators of compromise linked to the Stealc malware family, which is known for stealing credentials and exfiltrating sensitive data from compromised endpoints. Proactively hunting for these specific IOCs within Azure Sentinel allows the SOC team to rapidly detect early-stage infections and mitigate potential lateral movement before attackers can establish persistence or escalate privileges.

IOC Summary

Malware Family: Stealc Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`7f41c5645853c5085c49ccdd4d035ce137a09762`	payload	2026-07-27	95%
md5_hash	`deac2af8f25970ebdf88d617037f6b56`	payload	2026-07-27	95%
sha256_hash	`17d5023a4778003af6f2d2a02d9e8b3719b9a3c78e314a25b5652e965e95906c`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Stealc
let malicious_hashes = dynamic(["7f41c5645853c5085c49ccdd4d035ce137a09762", "deac2af8f25970ebdf88d617037f6b56", "17d5023a4778003af6f2d2a02d9e8b3719b9a3c78e314a25b5652e965e95906c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Stealc IOCs rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Antivirus Engine Signature Updates
- Context: Enterprise endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender ATP) frequently download new definition files or heuristic signatures from their cloud update servers. These downloads often contain hash values that match known Stealc IOCs due to shared code libraries or overlapping vendor repositories.
- Filter/Exclusion: Create a process exclusion for the specific antivirus service executables (e.g., C:\Program Files\CrowdStrike\fs_qc.exe or C:\Windows\System32\DefenderService.exe) when they initiate network connections to known update endpoints, excluding them from IOC matching logic.
Scenario: Scheduled Patch Management Deployments
- Context: Automated patching tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons execute scheduled jobs during maintenance windows. These agents often download large payloads containing installer binaries that may trigger the Stealc IOC detection logic, particularly if the payload includes a specific DLL or executable hash flagged by ThreatFox.
- Filter/Exclusion: Implement a time-based exclusion for the rule between 02:00 and 06:00 UTC (standard maintenance windows) specifically for processes spawned by ccmsetup.exe or ivantiagent.exe, provided the source IP belongs to the internal patch server subnet.
Scenario: Internal Software Distribution via Group Policy
- Context: When IT administrators push new software installations to workstations using Group Policy (GPO) or tools like PDQ Deploy, the deployment agents download installation packages from an internal file share or distribution point. These packages often include standard utility libraries that overlap with Stealc