ThreatFox: Agent Tesla IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying Agent Tesla remote access trojans to establish persistence and exfiltrate sensitive data via known indicators of compromise. Proactively hunting for these specific IOCs within Azure Sentinel is critical to identify early-stage infections before the malware can fully execute its command-and-control communications or escalate privileges.

IOC Summary

Malware Family: Agent Tesla Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`c9699aab5b60601b25da974dc06708b0c3b78b4c`	payload	2026-07-02	95%
md5_hash	`d8ff995ca4b9a9a2018b852331c1d0f6`	payload	2026-07-02	95%
sha256_hash	`e131a1db2de30ed970ca887afe7153f0611215f663019c9296ae1a075cfd3245`	payload	2026-07-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Agent Tesla
let malicious_hashes = dynamic(["c9699aab5b60601b25da974dc06708b0c3b78b4c", "d8ff995ca4b9a9a2018b852331c1d0f6", "e131a1db2de30ed970ca887afe7153f0611215f663019c9296ae1a075cfd3245"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Agent Tesla

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Agent Tesla IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Endpoint Protection Scanning and Quarantine Operations
- Scenario: The organization’s EDR solution (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) performs scheduled deep scans or on-demand remediation tasks. During these operations, the EDR agent may generate file hashes, registry keys, or network connections that match Agent Tesla IOCs as part of its own signature database updates or heuristic analysis of known good artifacts.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from the specific process names and installation paths of the deployed EDR agents (e.g., MsMpEng.exe, csagent.exe, SentinelOneAgent.exe) when they are executing scheduled scan jobs or updating their definition databases.
IT Asset Management and Software Inventory Scans
- Scenario: Automated asset discovery tools like Lansweeper, SCCM (System Center Configuration Manager), or Ivanti perform periodic inventory sweeps across the network. These tools often install lightweight agents that enumerate installed software, registry keys, and active processes to build a hardware/software catalog. If the IT department has previously tested Agent Tesla in a pilot phase or maintains it as a reference artifact, these scanners may flag its associated IOCs during routine discovery cycles.
- Filter/Exclusion: Exclude alerts triggered by known asset management service accounts (e.g., DOMAIN\SCCM-Service-Account, DOMAIN\Lansweeper-Agent) and restrict the detection scope to exclude specific inventory scan job IDs or scheduled task names (e.g., “Software Inventory Scan,” “Hardware Discovery”).
Security Baseline Compliance Audits
- Scenario: Compliance automation frameworks such as Qualys, Tenable Ness