ThreatFox: Stealc IOCs

Hunt Hypothesis

This rule detects the presence of Stealc malware, which exfiltrates sensitive data and steals credentials through covert communication channels often established via phishing-delivered payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the malware from successfully establishing persistent command-and-control connections and extracting critical assets before they are exfiltrated.

IOC Summary

Malware Family: Stealc Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Stealc
let malicious_urls = dynamic(["http://160.20.109.59", "https://api.mb2-rrfdnb-ip38z5.shop", "https://api.mb2-rrfdnb-ip38z5.shop/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Stealc

False Positive Guidance

• Legitimate Phishing Simulation Campaigns: Security teams often use tools like GoPhish or KnowBe4 to simulate phishing attacks for user training. These simulations may use shorteners or redirect chains that mimic the “malicious URL redirect” behavior of Stealc, triggering alerts if the simulation domains are not whitelisted.
  • Filter/Exclusion: Exclude known phishing simulation platform domains (e.g., *.gophish.io, *.knowbe4.com) or tag traffic from the simulation server IP range as “Phishing Sim” in the SIEM.
• Enterprise Web Proxy Caching and Redirects: Corporate web proxies (e.g., Zscaler, Forcepoint, or Squid) often insert 302 redirects for policy enforcement, SSL interception, or content filtering. If the proxy’s redirect header contains specific user-agent strings or path patterns that overlap with Stealc’s known IOCs, it can cause false positives on legitimate user browsing.
  • Filter/Exclusion: Exclude HTTP responses where the Server header matches known proxy signatures (e.g., Zscaler, Forcepoint) or filter out requests where the X-Forwarded-For chain indicates internal proxy infrastructure.
• Scheduled Backup and Sync Jobs: Tools like Veeam, Rubrik, or Synology Drive often establish persistent outbound connections to cloud storage endpoints or backup repositories. If these endpoints use dynamic DNS or specific API paths that match Stealc’s C2 URL patterns, the regular scheduled syncs (e.g., nightly backups) can trigger the rule.
  • Filter/Exclusion: Create a baseline of known backup/sync service endpoints (e.g., *.rubrik.com, *.veeam.com) and exclude outbound connections to these domains from the Stealc IOC list, or filter by process name (e.g., veeam.exe, `rub