ThreatFox: SalatStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior where malicious actors deploy the SalatStealer infostealer to exfiltrate sensitive credentials and browser data using specific known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification allows the SOC team to isolate compromised endpoints before the stealer establishes persistence or expands its lateral movement across the cloud environment.

IOC Summary

Malware Family: SalatStealer Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8`	payload	2026-07-16	95%
sha1_hash	`fcb14e821e391defa8096c553066e5f555280de0`	payload	2026-07-16	95%
md5_hash	`23285f10bb9b3002a24d3dbf865f07e1`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - SalatStealer
let malicious_hashes = dynamic(["9a0cea11f75f63bbff8d0cea420787da972e78d8eb3baa14cd575f55bde369d8", "fcb14e821e391defa8096c553066e5f555280de0", "23285f10bb9b3002a24d3dbf865f07e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — SalatStealer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: SalatStealer IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled deep scan of the C:\Quarantine\Threats directory. This directory contains archived, benign versions of the specific SalatStealer IOCs (hashes or file paths) previously identified and isolated by security teams. The EDR agent generates network or process events matching these known safe artifacts during its routine maintenance window.
- Filter/Exclusion: Exclude alerts where the Parent_Process_Name is the EDR service executable (e.g., csfalcon.exe, MsMpEng.exe) and the File_Path contains keywords like \Quarantine\, \Archive\, or \Staging\.
Software Deployment via Configuration Management Tools
- Scenario: The IT Operations team utilizes a configuration management tool (e.g., Ansible, SCCM/MECM, or Puppet) to deploy a new browser security extension or a specific patch for the organization’s standard web browser. During the deployment phase, the installer extracts and temporarily writes files that match the SalatStealer IOCs to the %TEMP% directory before finalizing the installation on user endpoints.
- Filter/Exclusion: Create an exclusion rule for process names associated with deployment agents (e.g., ccmexec.exe, Ansible-Runner.exe) and restrict the scope to file paths under %TEMP%\SoftwareDistribution\ or specific deployment package directories, provided the event occurs during standard business hours.
Scheduled Antivirus Signature Updates
- Scenario: The centralized AV management console (e.g