ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the execution of known SalatStealer indicators to detect active credential and data theft campaigns within the environment. Proactively hunting these specific IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised assets before the malware exfiltrates sensitive information or establishes persistence mechanisms.

IOC Summary

Malware Family: SalatStealer Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`30d9b5c56983375335bee44843115b393b7c711b`	payload	2026-07-18	95%
md5_hash	`58224bee686c03b0f7394a459d3ff971`	payload	2026-07-18	95%
sha1_hash	`0f8a097b3bb53c2bdd08ca1b23b749e6b2ca1f2a`	payload	2026-07-18	95%
md5_hash	`466d3130f4f427ec39fb1378ee142e6f`	payload	2026-07-18	95%
sha256_hash	`f2b9739fe3aced2d2074db022b5d1e23003b44fbc24413f3bd3298f1623c6665`	payload	2026-07-18	95%
sha256_hash	`16a4a7b5a478ce3dd732b318f7dfadbd337ab51d804a0a261623ea941417fd5f`	payload	2026-07-18	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["30d9b5c56983375335bee44843115b393b7c711b", "58224bee686c03b0f7394a459d3ff971", "0f8a097b3bb53c2bdd08ca1b23b749e6b2ca1f2a", "466d3130f4f427ec39fb1378ee142e6f", "f2b9739fe3aced2d2074db022b5d1e23003b44fbc24413f3bd3298f1623c6665", "16a4a7b5a478ce3dd732b318f7dfadbd337ab51d804a0a261623ea941417fd5f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, tailored for an enterprise environment:

Scheduled Antivirus Definition Updates via WSUS/SCCM
- Scenario: The organization’s automated patch management system (e.g., Microsoft SCCM or WSUS) pushes a security definition update package that includes a specific hash or file path matching one of the SalatStealer IOCs. This often occurs during the nightly maintenance window when the Antimalware Service Executable downloads and installs new signatures, triggering a match on the network traffic or file creation event.
- Filter/Exclusion: Create an exclusion rule for the specific process path C:\Program Files\Microsoft Antimalware\MsMpEng.exe (or the specific AV vendor’s service executable) originating from the internal IP range of the Patch Management Server. Additionally, exclude the specific file hash if it is known to be a legitimate signature update package.
Enterprise Endpoint Configuration Manager (MECM/SCCM) Software Deployment
- Scenario: The IT operations team deploys a new application or configuration baseline using Microsoft Endpoint Configuration Manager. The deployment agent (ccmexec.exe) downloads a compressed installer or script from an internal distribution point that contains a shared library or dependency file matching the SalatStealer IOC (e.g., a specific DLL hash used across multiple enterprise apps).
- Filter/Exclusion: Exclude network connections and file creation events where the parent process is ccmexec.exe and the destination/source IP belongs to the internal Distribution Point subnet. Alternatively, whitelist the specific SHA-256 hash of the legitimate installer package in the detection rule logic.
Automated Backup Jobs via Veeam or Commvault
- Scenario: A nightly backup job runs using enterprise software like Veeam Backup & Replication or Comm