ThreatFox: TerraStealer IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where TerraStealer malware actively extracts credentials, sensitive files, and system data from compromised endpoints to facilitate large-scale exfiltration. A SOC team should proactively hunt for these indicators in Azure Sentinel because early detection of this high-severity threat prevents the loss of critical assets and limits the attacker’s ability to pivot within the environment.

IOC Summary

Malware Family: TerraStealer Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`e202edf94b706e5596283aa3456760de6bcbcd54`	payload	2026-08-04	95%
md5_hash	`6435611106d0d7b3301229b9021a9908`	payload	2026-08-04	95%
sha1_hash	`71147bd6657f1dc2837aaa54d2b4567ebb81ef31`	payload	2026-08-04	95%
md5_hash	`83928513bb5518e71704d089dedfe44d`	payload	2026-08-04	95%
sha256_hash	`0d29741bb7161b12319909ecbbfb6029b08fe80c98fc8a93658ea14fededdfd9`	payload	2026-08-04	95%
sha256_hash	`bc7d5b9ae130f1b9c5a41517d56d9213950ef7f9b1ed78d9f33a4b2797d009e1`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - TerraStealer
let malicious_hashes = dynamic(["e202edf94b706e5596283aa3456760de6bcbcd54", "6435611106d0d7b3301229b9021a9908", "71147bd6657f1dc2837aaa54d2b4567ebb81ef31", "83928513bb5518e71704d089dedfe44d", "0d29741bb7161b12319909ecbbfb6029b08fe80c98fc8a93658ea14fededdfd9", "bc7d5b9ae130f1b9c5a41517d56d9213950ef7f9b1ed78d9f33a4b2797d009e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — TerraStealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: TerraStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Backup Agents Scanning Credential Stores
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik periodically scan local user profiles (C:\Users\...) and system directories to back up sensitive data. These agents often access credential stores (e.g., vcred.cred, browser profile folders) which triggers the rule’s file access logic associated with TerraStealer’s exfiltration behavior.
- Filter/Exclusion: Create an exclusion based on the specific process image path of the backup service (e.g., C:\Program Files\Veeam\Backup and Replication Services\EngineService.exe) or exclude network traffic originating from the dedicated backup server subnet when accessing standard user profile paths.
Scenario: Scheduled Endpoint Security Scans
- Context: Managed endpoint protection platforms such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne run scheduled deep scans that enumerate registry keys, read browser history files (Chrome/Edge), and inspect certificate stores. These actions mimic the reconnaissance phase of TerraStealer, causing high-volume file reads on sensitive artifacts like NTDS.dit or browser JSON profiles.
- Filter/Exclusion: Exclude processes matching the known security vendor binaries (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Windows\System32\MsMpEng.exe) during their defined maintenance windows (e.g., 02:00 – 04:00 local time) from triggering this specific IOC alert.
Scenario: Admin Credential Harvesting via PowerShell
- Context: System administrators