ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy SalatStealer to exfiltrate sensitive credentials and browser data using a specific set of six known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate affected assets before the stealer establishes persistence or expands its lateral movement across the cloud environment.

IOC Summary

Malware Family: SalatStealer Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`f59b521321526c8e255c6e5a9ed71d063349cab55a4a0b7207c6aa0039fb32be`	payload	2026-06-29	95%
sha1_hash	`58be67baa9a3323e8f0554ff45147668d5abf8ba`	payload	2026-06-29	95%
md5_hash	`5563f909b93845410a8014ddffa5adf6`	payload	2026-06-29	95%
sha256_hash	`9977df7ffd04173d38e0aefe3d028052e164aaa69c1facfe63af55b473dd9e24`	payload	2026-06-29	95%
sha1_hash	`1ceb390d2b85599cc738bfadcdddceaa01083940`	payload	2026-06-29	95%
md5_hash	`7f79817eb5e3579ce8957a42c31c65fa`	payload	2026-06-29	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["f59b521321526c8e255c6e5a9ed71d063349cab55a4a0b7207c6aa0039fb32be", "58be67baa9a3323e8f0554ff45147668d5abf8ba", "5563f909b93845410a8014ddffa5adf6", "9977df7ffd04173d38e0aefe3d028052e164aaa69c1facfe63af55b473dd9e24", "1ceb390d2b85599cc738bfadcdddceaa01083940", "7f79817eb5e3579ce8957a42c31c65fa"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Scanning of Quarantine Directories
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs deep heuristic scans on the C:\ProgramData\ThreatFox\Quarantine directory. During this process, the scanner extracts and analyzes a known benign test file that shares a hash with one of the SalatStealer IOCs (specifically a shared DLL used in internal testing).
- Filter/Exclusion: Create an exclusion rule for the EDR agent to skip deep scanning or alerting on files within the ThreatFox\Quarantine path, or whitelist the specific file hash if it is confirmed as a benign test artifact.
Scheduled Software Deployment via SCCM
- Scenario: A nightly scheduled task managed by Microsoft Endpoint Configuration Manager (MECM/SCCM) deploys a patch to the C:\Windows\Temp folder. The deployment package includes a legitimate update for an internal inventory tool that inadvertently contains a binary component with a SHA-256 hash matching one of the SalatStealer IOCs due to a shared open-source library dependency.
- Filter/Exclusion: Exclude alerts originating from the C:\Windows\Temp directory when the parent process is identified as ccmexec.exe (SCCM) or msiexec.exe, specifically during the maintenance window hours (e.g., 02:00 – 04:00 UTC).
Security Information and Event Management (SIEM) Log Ingestion
- Scenario: The SIEM platform (e.g., Splunk or Sentinel) ingests a large volume of log files from the corporate proxy