Agent Tesla v4 Emoji Obfuscation Campaign: Detection and Defense Guide for SOC Teams

---
title: Office Application Spawning Suspicious Child Process
description: Detects Microsoft Office applications spawning script interpreters or executables, consistent with Agent Tesla phishing document execution chains.
references:
  - https://attack.mitre.org/techniques/T1566/001/
  - https://www.infosecurity-magazine.com/news/agent-tesla-malware-evasion/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: process_creation
  product: windows
detection:
  parent_office:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  child_suspicious:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msbuild.exe'
      - '\vbc.exe'
      - '\csc.exe'
  condition: parent_office and child_suspicious
falsepositives:
  - Rare legitimate Office add-in behavior; MSBuild/csc/vbc children of Office are almost never legitimate
level: high
---
title: Agent Tesla Registry Run Key Persistence
description: Detects suspicious executable paths being written to Run keys, a hallmark Agent Tesla persistence mechanism. Focuses on user-writable and temp locations that legitimate software rarely uses for autostart.
references:
  - https://attack.mitre.org/techniques/T1547/001/
  - https://www.infosecurity-magazine.com/news/agent-tesla-malware-evasion/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: registry_set
  product: windows
detection:
  reg_target:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
  suspicious_path:
    Details|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_known_good:
    Details|contains:
      - 'OneDrive'
      - 'Teams'
      - 'Spotify'
      - 'Slack'
  condition: reg_target and suspicious_path and not filter_known_good
falsepositives:
  - Legitimate user-installed applications that autostart from AppData; tune the filter list per environment baseline
level: medium
---
title: Non-Mail Process Initiating SMTP Connection to External Host
description: Detects processes other than legitimate mail clients establishing outbound SMTP (25/465/587) connections, consistent with Agent Tesla's classic SMTP-based credential exfiltration.
references:
  - https://attack.mitre.org/techniques/T1048/003/
  - https://www.infosecurity-magazine.com/news/agent-tesla-malware-evasion/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: network_connection
  product: windows
detection:
  smtp_ports:
    DestinationPort:
      - 25
      - 465
      - 587
  filter_mail_clients:
    Image|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\eMClient.exe'
      - '\hxtsr.exe'
  condition: smtp_ports and not filter_mail_clients
falsepositives:
  - Line-of-business applications with email alerting features; scanner/MFP relay traffic. Baseline and suppress known senders by Image hash
level: high

// Hunt for Agent Tesla behavioral chain in Microsoft Defender / Sentinel
// Part 1: Office-spawned processes writing Run key persistence within 10 minutes
let OfficeSpawn =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe")
    | where FileName in~ ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","msbuild.exe")
    | project DeviceId, SpawnTime=TimeGenerated, ChildProcess=FileName, ChildCmd=ProcessCommandLine, DeviceName;
let RunKeyWrite =
    DeviceRegistryEvents
    | where TimeGenerated > ago(7d)
    | where RegistryKey has_any ("\\CurrentVersion\\Run","\\CurrentVersion\\RunOnce")
    | where RegistryValueData has_any ("\\AppData\\","\\Temp\\","\\Users\\Public\\","\\ProgramData\\")
    | project DeviceId, RegTime=TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName;
OfficeSpawn
| join kind=inner RunKeyWrite on DeviceId
| where abs(datetime_diff('minute', RegTime, SpawnTime)) <= 10
| project DeviceName, SpawnTime, ChildProcess, ChildCmd, RegistryKey, RegistryValueName, RegistryValueData
| sort by SpawnTime desc;
// Part 2: Non-mail processes making SMTP egress connections (classic Agent Tesla exfil)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (25, 465, 587)
| where InitiatingProcessFileName !in~ ("outlook.exe","thunderbird.exe","eMClient.exe","hxtsr.exe")
| where RemoteIPType == "Public"
| summarize Connections=count(), DistinctDestinations=dcount(RemoteIP), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort
| where DistinctDestinations >= 1
| sort by Connections desc;
// Part 3: Telegram Bot API usage from endpoints (Agent Tesla alternative exfil channel)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has "api.telegram.org" or RemoteIP has "149.154."
| where InitiatingProcessFileName !in~ ("Telegram.exe")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count()
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| sort by Hits desc

-- Velociraptor hunt: Agent Tesla persistence and execution artifacts
-- Combines Run key entries pointing to user-writable paths with live process
-- and network correlation. Deploy as a hunt across the fleet.

-- Artifact 1: Suspicious Run key persistence
SELECT Key.FullPath AS RegKey,
       Value.Name AS ValueName,
       Value.String AS ValueData,
       Key.Mtime AS LastWrite
FROM stat(filename='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*')
WHERE ValueData =~ '(?i)appdata|temp|public|programdata'
  AND NOT ValueData =~ '(?i)onedrive|teams|spotify|slack'

-- Artifact 2: Live processes with SMTP egress (classic Agent Tesla exfil)
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username
FROM pslist()
WHERE Name =~ '(?i)outlook|thunderbird' = FALSE
  AND Pid IN (
      SELECT Pid FROM netstat()
      WHERE RemotePort IN (25, 465, 587)
        AND Status = 'ESTABLISHED'
  )

-- Artifact 3: Recently created executables in common Agent Tesla drop locations
SELECT FullPath,
       Size,
       Mtime,
       Ctime
FROM glob(globs=[
    'C:/Users/*/AppData/Roaming/**/*.exe',
    'C:/Users/*/AppData/Local/Temp/*.exe',
    'C:/Users/Public/**/*.exe'
])
WHERE Ctime > now() - 604800
ORDER BY Ctime DESC

# Agent Tesla remediation and hardening script — run elevated on suspected endpoints
# 1. Audit Run/RunOnce keys for suspicious persistence entries
$runKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
$suspiciousPattern = 'AppData|\\Temp\\|Users\\Public|ProgramData'
$findings = @()
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $props = Get-ItemProperty -Path $key
        foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notmatch '^PS' })) {
            if ($props.$name -match $suspiciousPattern -and $props.$name -notmatch 'OneDrive|Teams|Spotify|Slack') {
                $findings += [PSCustomObject]@{ Key=$key; Name=$name; Value=$props.$name }
            }
        }
    }
}
if ($findings) {
    Write-Host '[!] Suspicious persistence entries found:' -ForegroundColor Red
    $findings | Format-Table -AutoSize
    # Quarantine: export then remove after IR approval
    # $findings | ForEach-Object { Remove-ItemProperty -Path $_.Key -Name $_.Name }
} else {
    Write-Host '[+] No suspicious Run key entries detected.' -ForegroundColor Green
}

# 2. Kill and suspend processes with active SMTP egress that are not mail clients
$smtpConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 25,465,587 -and $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' }
foreach ($conn in $smtpConns) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Name -notmatch '^(outlook|thunderbird|emclient|hxtsr)$') {
        Write-Host "[!] Non-mail SMTP egress: $($proc.Name) (PID $($proc.Id)) -> $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
        # Stop-Process -Id $proc.Id -Force   # Uncomment after IR approval
    }
}

# 3. Hardening: block Office child processes via Attack Surface Reduction rule
# ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions Enabled
# ASR rule: Block executable content from email client and webmail
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
    -AttackSurfaceReductionRules_Actions Enabled
Write-Host '[+] ASR rules enforced for Office child process and email content blocking.' -ForegroundColor Green

# 4. Verify: confirm ASR rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids