ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying the SalatStealer infostealer to exfiltrate sensitive credentials and browser data by leveraging its known set of twelve Indicators of Compromise (IOCs). The SOC team should proactively hunt for these specific IOCs within Azure Sentinel to identify early-stage infections before they escalate into significant data breaches or lateral movement events.

IOC Summary

Malware Family: SalatStealer Total IOCs: 12 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["a3c1ef1092965bc58c12d579a889f296", "3e5560670aeaf9ae87844f896264751efc1446cd", "968b49795eddd02848759e0f1cf7c838", "d9e8f073c050b9f75f78003c05cc77bc0b60fb5bbdfb980fe6216fa0fd8ace6a", "0cb3f9f77acf2075a6074b05b56ab1b54125226d", "e08ba6b6bd164546cc8f8819ab67d22f7a410d6fe9bbb2e350dbe24786e93d55", "d653ada71dcf3f24d2d6dd5ef22a169b", "ec84b042161c8037b5e6d556dc7795c10788f24c", "f77dafb7f7cf6d7c3318f8ff01fa5e6d", "d632a7428a5a8a6c4642ba4ddecfbbe96e28ed030a204156c5018527ba4a6b46", "cf236e17e176cacaa951e086637bf62c04635080", "a6b325e695644ddaaf6edf0c41604179fd53d1e515afa52e5d526426a4644d76"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — SalatStealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Security Tool Signature Updates: Legitimate updates to endpoint protection agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often download and execute new definition files that match the hash values of SalatStealer’s known IOCs. These updates are typically triggered during maintenance windows by the management console.

  • Suggested Filter: Exclude events originating from specific service accounts used by security tools (e.g., svc-crowdstrike-updater, MSDefenderUpdate) or restrict alerts to non-standard execution paths if the IOC is a known update file location (e.g., C:\ProgramData\Microsoft\Windows Defender\Platform).

• Software Deployment via SCCM/Intune: System administrators frequently deploy new applications or patches using Microsoft Endpoint Configuration Manager (MECM) or Intune. The deployment scripts often download installer packages from internal repositories that may share file hashes with the SalatStealer IOCs, particularly if the repository hosts third-party software bundles.

  • Suggested Filter: Create an exclusion for processes spawned by known deployment engines such as ccmexec.exe (SCCM), intune-management-agent, or msiexec.exe when launched from the C:\Windows\CCM directory, specifically during scheduled maintenance windows defined in the IT calendar.

• Third-Party Backup and Monitoring Agents: Enterprise backup solutions like Veeam Backup & Replication or monitoring tools like Datadog often run background agents that scan file systems and network shares. These agents may generate temporary files or execute scripts with hashes identical to SalatStealer IOCs while performing routine data indexing or integrity checks.

  • Suggested Filter: Exclude events where the parent process is a recognized backup/monitoring service (e