ThreatFox: Unknown Stealer IOCs

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of known stealer malware indicators that may represent novel or previously unseen threats within the environment. Proactive hunting for these Unknown Stealer IOCs in Azure Sentinel is critical to rapidly identify and contain data exfiltration attempts before they compromise sensitive credentials or intellectual property.

IOC Summary

Malware Family: Unknown Stealer Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown Stealer
let malicious_domains = dynamic(["loveloveinfo.xyz", "searchranktraffic.live", "robbylinkpi.icu"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown Stealer

False Positive Guidance

Here are 4 specific scenarios that could trigger the ThreatFox: Unknown Stealer IOCs rule in a legitimate enterprise environment, along with suggested filters or exclusions for each:

• Endpoint Protection Agent Self-Updates and Scans

  • Scenario: Security agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently download new signature definitions or perform heuristic scans. These processes often spawn child executables in temporary directories (C:\Windows\Temp or %TEMP%) that match the “unknown” criteria of stealer IOCs before they are fully whitelisted by the vendor’s internal reputation service.
  • Filter/Exclusion: Create an exclusion for the specific parent process names of your EDR agents (e.g., csagent.exe, MsMpEng.exe, SentinelOneAgent.exe) and restrict the alert scope to exclude file paths containing standard update folders like \Program Files\Microsoft Defender\ or \CrowdStrike\.

• IT Administration via Remote Management Tools

  • Scenario: System administrators use remote management suites (e.g., Ivanti, SCCM/MECM, or TeamViewer) to deploy scripts or patches. During these sessions, the admin tool may execute a generic PowerShell script (powershell.exe) that downloads a configuration file from an internal repository. If this downloaded file is new and lacks a global reputation score, it triggers the “Unknown Stealer” logic while mimicking data exfiltration behavior.
  • Filter/Exclusion: Exclude alerts where the parent process belongs to known RMM tools (e.g., IvantiAgent.exe, ccmexec.exe) or filter by user context to exclude accounts belonging to the “IT-Admins” security group during business hours (08:00–18:00).

• **Scheduled Software Deployment and