ThreatFox: Stealc IOCs

Hunt Hypothesis

This detection rule identifies the presence of Stealc malware, which establishes covert communication channels to exfiltrate sensitive credentials and system data following initial compromise via phishing vectors. Proactively hunting for these indicators within Azure Sentinel is critical to rapidly isolate infected endpoints and prevent unauthorized data leakage before adversaries can establish persistent access or escalate privileges.

IOC Summary

Malware Family: Stealc Total IOCs: 2 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://43.228.157.66", "http://2.27.5.214"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Stealc

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Phishing Simulation Platforms

  • Context: Enterprise security teams frequently use platforms like KnowBe4, Proofpoint Security Awareness Training, or Cognito Forms to conduct simulated phishing campaigns. These tools often deliver emails containing tracking pixels, embedded images, or downloadable PDFs that mimic the behavioral footprint of Stealc (e.g., establishing outbound connections to specific IP ranges used by these vendors).
  • Filter/Exclusion: Create an exclusion rule for traffic originating from known simulation vendor domains (e.g., *.knowbe4.com, *.proofpoint.com) and specific destination IPs associated with their content delivery networks. Additionally, exclude alerts where the source user account is a member of the “Security Training Admins” group.

• Scenario: Scheduled Backup and Exfiltration Jobs

  • Context: Stealc is known for data exfiltration via covert channels. In many environments, scheduled tasks running tools like Veeam, Rubrik, or Microsoft Azure Backup Agent perform nightly data uploads to cloud storage. These jobs establish persistent outbound connections and transfer large volumes of metadata, which can trigger the “covert communication” logic of the Stealc rule.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00 – 04:00 local time). Furthermore, exclude processes identified as backup agents (e.g., Veeam.Backup.Service.exe, AzureBackupAgent.exe) when they initiate connections to approved cloud storage endpoints.

• Scenario: Endpoint Management and Patching Tools

  • Context: Stealc often arrives via phishing and