ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with the SalatStealer infostealer by identifying network connections and file artifacts matching three specific Indicators of Compromise (IOCs). Proactively hunting for these signals in Azure Sentinel is critical to rapidly identify early-stage credential theft and browser data exfiltration before the malware establishes persistence or expands its lateral movement.

IOC Summary

Malware Family: SalatStealer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8`	payload	2026-07-16	95%
sha1_hash	`fcb14e821e391defa8096c553066e5f555280de0`	payload	2026-07-16	95%
md5_hash	`23285f10bb9b3002a24d3dbf865f07e1`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8", "fcb14e821e391defa8096c553066e5f555280de0", "23285f10bb9b3002a24d3dbf865f07e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Antivirus/EDR Scheduled Scans on Known Paths
- Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform scheduled deep scans. During these scans, the EDR engine may generate temporary network connections or file access events that match SalatStealer’s IOCs (specifically C2 domains or hash values of legitimate update components) as they query their own cloud infrastructure.
- Filter/Exclusion: Create a rule exclusion for processes originating from known EDR service executables (e.g., C:\Program Files\CrowdStrike\csagent.exe or MsMpEng.exe) when the destination IP belongs to the vendor’s trusted CIDR ranges (e.g., CrowdStrike US/EU regions).
Software Deployment via Configuration Management Tools
- Scenario: IT administrators use tools like Microsoft SCCM, Ivanti, or Ansible to push application updates. These deployment agents often download installation packages from internal artifact repositories (like JFrog Artifactory or Azure Artifacts) that host binaries with hashes matching the SalatStealer IOCs, particularly if the organization uses a shared library of standard software components.
- Filter/Exclusion: Exclude alerts where the parent process is identified as a deployment agent (e.g., ccmexec.exe, AnsibleAgent.exe) and the source IP address resolves to the internal corporate file server or artifact repository subnet rather than an external public IP.
Automated Backup and Data Synchronization Jobs
- Scenario: Scheduled backup jobs utilizing tools like **Veeam Backup