ThreatFox: Stealc IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying Stealc malware within the environment by leveraging known indicators of compromise to establish persistence and exfiltrate sensitive data. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly identify early-stage infections before they escalate into broader lateral movement or data loss incidents.

IOC Summary

Malware Family: Stealc Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`77[.]90[.]185[.]121:80`	botnet_cc	2026-07-12	75%
ip:port	`172[.]86[.]113[.]33:80`	botnet_cc	2026-07-12	75%
ip:port	`77[.]90[.]185[.]122:80`	botnet_cc	2026-07-12	75%
ip:port	`85[.]120[.]81[.]21:80`	botnet_cc	2026-07-12	75%
ip:port	`160[.]20[.]109[.]68:80`	botnet_cc	2026-07-12	75%
ip:port	`158[.]94[.]210[.]57:80`	botnet_cc	2026-07-12	75%
ip:port	`158[.]94[.]211[.]3:80`	botnet_cc	2026-07-12	75%
ip:port	`181[.]174[.]164[.]6:80`	botnet_cc	2026-07-12	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Stealc
let malicious_ips = dynamic(["77.90.185.122", "158.94.210.57", "172.86.113.33", "158.94.211.3", "85.120.81.21", "160.20.109.68", "181.174.164.6", "77.90.185.121"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["77.90.185.122", "158.94.210.57", "172.86.113.33", "158.94.211.3", "85.120.81.21", "160.20.109.68", "181.174.164.6", "77.90.185.121"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Stealc

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Stealc IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

Endpoint Protection Scanning of Quarantine Archives
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a deep scan of the “Quarantine” folder where it stores archived malicious samples. If Stealc IOCs are present in these historical archives, the detection logic triggers an alert even though the files are isolated and non-executable.
- Filter/Exclusion: Exclude file paths containing \ProgramData\Microsoft\Windows Defender\Quarantine or specific EDR vendor quarantine directories (e.g., C:\ProgramData\CrowdStrike\Logs\Quarantine). Additionally, filter for processes running under the EDR service account (e.g., svc_falcon) rather than user contexts.
Software Development & QA Testing Environments
- Scenario: In a DevOps pipeline or QA lab, developers frequently download and execute sample malware datasets to validate new detection signatures. A scheduled job using tools like Ansible or Jenkins may deploy Stealc test artifacts (IOCs) onto build agents to verify the efficacy of the ThreatFox feed integration.
- Filter/Exclusion: Create an exclusion for host groups tagged as Environment: Dev or Environment: QA. Alternatively, filter out events where the parent process is a known CI/CD orchestrator (e.g., jenkins-agent.exe, ansible-runner.exe) executing within designated test subnets.
IT Administration and Patch Management Deployments
- Scenario: During routine patch management cycles, administrators use tools like SCCM (Microsoft Endpoint Configuration Manager) or Ivanti to push security updates that include