ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying Agent Tesla remote access trojans to establish persistence and exfiltrate sensitive data via known network indicators of compromise. The SOC team should proactively hunt for these specific IOCs within Azure Sentinel to rapidly identify early-stage infections before the malware can fully execute its command-and-control routines or escalate privileges.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 8 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Agent Tesla
let malicious_domains = dynamic(["ftp.acellemez.hu", "ftp.3dsportsgins.com", "ftp.dankely.org", "ftp.enogcaen-br.com", "ftp.telewatte-pe.com", "ftp.hivimer.com", "ftp.avion.com.sg", "ftp.vilimorin.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Agent Tesla

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Management Console Updates

  • Scenario: The centralized management server (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) pushes a scheduled configuration update or policy refresh to the agent service. This process often involves writing temporary files, modifying registry keys under HKLM\Software, and executing background scripts that match the file hashes or network beaconing patterns of Agent Tesla IOCs.
  • Filter/Exclusion: Exclude processes spawned by known EDR management services (e.g., falcon.sys, sentinel-agent.exe) and whitelist specific registry keys modified during policy synchronization windows.

• IT Asset Inventory Scans

  • Scenario: Automated discovery tools like SolarWinds NCM, ** Lansweeper**, or Microsoft SCCM/MECM run scheduled inventory jobs to audit installed software, hardware configurations, and network connectivity on endpoints. These agents frequently execute PowerShell scripts that enumerate running processes and open ports, generating file system activity and network traffic signatures identical to the Agent Tesla telemetry collection phase.
  • Filter/Exclusion: Create an exclusion for the specific service accounts used by inventory tools (e.g., svc-lansweeper, SCCMAgent) and filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these scans are known to run.

• Patch Management Deployment

  • Scenario: During a standard patching cycle using tools like WSUS, Ivanti Patch, or ManageEngine Endpoint Central, the deployment agent downloads and installs updates. The installation process often triggers file creation in C:\Windows\Temp