ThreatFox: TerraStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of TerraStealer malware, which targets sensitive data such as browser credentials and SSH keys to facilitate lateral movement and persistent access. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of TerraStealer activity allows for rapid containment before attackers can exfiltrate critical secrets or compromise cloud infrastructure.

IOC Summary

Malware Family: TerraStealer Total IOCs: 2 IOC Types: md5_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - TerraStealer
let malicious_hashes = dynamic(["8401e96f3e47f9e0fb2544424acd1434", "30584a4b5f16c8125f62bfdbc24c939d21be3784"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — TerraStealer

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: TerraStealer IOCs detection rule in an enterprise environment:

• Scenario 1: Enterprise Backup Solutions Scanning Legacy Archives

  • Context: Major backup tools like Veeam Backup & Replication or Commvault often scan deep directory trees containing legacy .zip or .tar archives. TerraStealer is known for targeting specific file extensions; if a backup agent extracts or scans an archive containing a benign file with a hash matching the IOCs (e.g., a legitimate old installer), it triggers the alert.
  • Suggested Filter: Create an exclusion based on the Process Name of the backup service.
    • Filter Logic: Exclude if Process_Name IN ('VeeamTransport.exe', 'commvault_agent.exe') AND Parent_Process_Name = 'vssvc.exe'.

• Scenario 2: Software Deployment via Endpoint Management Tools

  • Context: During scheduled maintenance windows, tools like Microsoft Intune, SCCM (Configuration Manager), or Jamf push software updates. These agents frequently download and execute installers from vendor repositories that may contain the specific IOCs flagged by ThreatFox as part of a legitimate software package (e.g., a Java runtime update or a browser extension).
  • Suggested Filter: Exclude alerts where the parent process is a known deployment agent and the execution path resides within the standard application distribution folders.
    • Filter Logic: Exclude if Parent_Process_Name IN ('ccmexec.exe', 'JamfProAgent.exe') AND Process_Path CONTAINS '\Program Files\'.

• Scenario 3: Scheduled Antivirus or EDR Deep Scans

  • Context: During off-hours, CrowdStrike Falcon, SentinelOne, or **Microsoft