ThreatFox: RedLine Stealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where the RedLine Stealer malware executes on endpoints to harvest and exfiltrate critical credentials, including passwords and browser cookies. Proactively hunting for these specific IOCs in Azure Sentinel is essential to rapidly identify compromised assets before sensitive data leakage leads to broader lateral movement or identity theft within the organization.

IOC Summary

Malware Family: RedLine Stealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`9139a0817ef5a3c0f4e97e562c22b2bb878d981a`	payload	2026-07-14	95%
md5_hash	`6b1a870bc9aa0a5d88931278f4375f50`	payload	2026-07-14	95%
sha256_hash	`7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a`	payload	2026-07-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RedLine Stealer
let malicious_hashes = dynamic(["9139a0817ef5a3c0f4e97e562c22b2bb878d981a", "6b1a870bc9aa0a5d88931278f4375f50", "7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — RedLine Stealer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: RedLine Stealer IOCs detection rule, tailored for an enterprise environment:

Scheduled Browser Cookie Synchronization by IT Support Tools
- Scenario: Enterprise endpoint management tools like ManageEngine Desktop Central or Ivanti Endpoint Manager often run scheduled maintenance jobs (e.g., every Sunday at 2 AM) that scan and archive browser data to optimize disk space. These scans access the Cookies and Login Data SQLite databases in Chrome/Edge, generating file access patterns identical to RedLine’s exfiltration behavior.
- Suggested Filter: Exclude processes running under the specific service accounts of your EMM tools (e.g., svc_desktopcentral, IvantiAgent) or filter events where the parent process is the scheduled task scheduler (schtasks.exe or TaskSchedulerService).
Legitimate Credential Backup via Enterprise Password Managers
- Scenario: Organizations using LastPass Enterprise, 1Password, or Bitwarden deploy background agents that periodically back up vault data and sync browser extensions. These agents actively read the local storage of browsers to ensure credential integrity, triggering file reads on Web Data and Secure Cookies folders that mimic RedLine’s data harvesting logic.
- Suggested Filter: Create an exclusion for known legitimate process paths (e.g., C:\Program Files\LastPass\Agent\lastpass-agent.exe) and whitelist the specific network destinations where these vendors upload their backup telemetry.
Automated Software Deployment and Configuration Scripts
- Scenario: During routine software updates or configuration pushes, administrators utilize tools like Microsoft SCCM (MECM), Ansible, or custom PowerShell scripts. These scripts often extract user profiles to verify installation success, which involves reading browser profile directories (`App