ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This detection rule identifies adversary activity consistent with Agent Tesla malware by monitoring for specific indicators of compromise such as suspicious process execution and network connections to known malicious infrastructure. Proactively hunting for these behaviors in Azure Sentinel is critical because early identification of this remote access trojan allows the SOC team to contain potential data exfiltration and credential theft before lateral expansion occurs across the enterprise environment.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: domain, md5_hash, sha1_hash

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.maytestlasb.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["b4875cd62a35191d2d62b541a1b4e5505b71e0ed", "e57a87dc9ab5bd0bf814434f9579cfff"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment:

• IT Asset Management Scans via Lansweeper or PDQ Deploy

  • Scenario: During scheduled inventory sweeps, asset management tools like Lansweeper or PDQ Deploy execute remote PowerShell scripts to query hardware and software details. These scripts often invoke the wmic command or access specific registry keys (e.g., HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall) that overlap with Agent Tesla’s known IOCs for system enumeration.
  • Filter/Exclusion: Create an exclusion rule to suppress alerts where the process name is LansweeperAgent.exe or PDQDeployService.exe, and the parent process is a scheduled task (svchost.exe running under the System account). Additionally, exclude traffic originating from the specific IP subnets allocated to the IT Asset Management server group.

• Endpoint Detection and Response (EDR) Self-Healing or Policy Updates

  • Scenario: Enterprise EDR solutions such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently perform self-healing operations, policy synchronization, or real-time scanning updates. These actions often involve creating temporary files in the %TEMP% directory and accessing memory structures that mimic the behavior of Agent Tesla’s installation or update routines (specifically matching IOCs related to msiexec.exe launching child processes).
  • Filter/Exclusion: Configure a filter to ignore events where the file path contains known EDR directories (e.g., C:\Program Files\CrowdStrike\, C:\Windows\System32\wbem\) and the process signature matches the vendor’s code signing certificate. Specifically, exclude alerts triggered by `