This detection rule identifies adversary activity linked to the Stealc malware family by monitoring for specific indicators of compromise across the Azure Sentinel environment. Proactive hunting is essential because early identification of these 11 IOCs allows the SOC team to rapidly contain potential data exfiltration and credential theft before they escalate into a broader enterprise incident.
Malware Family: Stealc Total IOCs: 11 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 149[.]202[.]64[.]184:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 192[.]162[.]199[.]70:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 144[.]31[.]221[.]215:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 178[.]16[.]54[.]25:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 178[.]16[.]55[.]83:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 77[.]90[.]185[.]107:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 157[.]254[.]194[.]130:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 64[.]224[.]17[.]118:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 34[.]68[.]103[.]127:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 23[.]94[.]145[.]29:80 | botnet_cc | 2026-07-04 | 75% |
| ip:port | 171[.]22[.]108[.]162:80 | botnet_cc | 2026-07-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Stealc
let malicious_ips = dynamic(["178.16.55.83", "178.16.54.25", "157.254.194.130", "144.31.221.215", "23.94.145.29", "171.22.108.162", "64.224.17.118", "34.68.103.127", "77.90.185.107", "149.202.64.184", "192.162.199.70"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.55.83", "178.16.54.25", "157.254.194.130", "144.31.221.215", "23.94.145.29", "171.22.108.162", "64.224.17.118", "34.68.103.127", "77.90.185.107", "149.202.64.184", "192.162.199.70"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are four specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Protection Scanning of Quarantine Archives
C:\ProgramData\Microsoft\Windows Defender\Scans\Quarantine) where previous Stealc samples were previously isolated. The scanning engine may re-extract these known malicious files, triggering a match against the 11 IOCs even though the threat is contained and not actively executing on the host.\Quarantine\ or specific EDR process names (e.g., MsMpEng.exe, CortexSysmon.exe) when accessing files within the quarantine directory.Security Team Manual IOC Validation via PowerShell
Stealc_Sample_v1.exe or accesses a specific IOCs list, it will trigger the detection logic as if a new infection occurred.System account or specific service accounts (e.g., svc-security-ops) running in the context of known administrative workstations (OU: IT-Security-Admins).Scheduled Antivirus Definition Updates