Detect Agent Tesla by looking for credential theft patterns, suspicious use of email, clipboard, browser, or FTP data, and outbound traffic to unfamiliar command infrastructure. Check for phishing-related execution, persistence in user space, and processes that scrape stored credentials or keypresses. Hunt across endpoints and mail logs for repeated collection-and-exfiltration behaviour.
How to spot Agent Tesla in endpoint and mail telemetry
Detection works best when you look for the full steal-and-send pattern rather than any single indicator. Agent Tesla activity often shows up as credential theft, keylogging, browser or FTP data collection, and then outbound delivery to unfamiliar infrastructure. On its own, each signal can look ordinary; together, they form a much stronger hunting hypothesis.
Phishing is a common entry point, so review suspicious user execution that follows email delivery, attachment opening, or lure-driven downloads. From there, focus on whether the process starts touching stored browser data, mail profiles, clipboard content, or keystrokes, then attempts to stage or transmit that material. That collection-plus-exfiltration sequence is the behavioural core that matters.
Good detection also means understanding where Agent Tesla hides. It often persists in user space, blends into normal application directories, and uses process names or parent-child chains that do not match the user’s workflow. Search for unusual persistence methods, odd startup entries, and repeated outbound connections that are inconsistent with the host’s usual application profile.
What telemetry is most useful for hunting Agent Tesla?
Start with endpoints, email logs, and network telemetry together. Endpoint data can reveal keylogging, browser credential access, suspicious child processes, and persistence. Mail logs can show the lure path and the first execution moment. Network data is where you often see the exfiltration phase, especially repeated outbound traffic to domains or IPs the host has not contacted before.
When you review telemetry, look for a chain rather than a point-in-time event: a phishing message, a user execution event, access to stored secrets or session material, then outbound transmission. If the host also shows attempts to enumerate browser profiles, mail stores, clipboard activity, or FTP clients, the confidence increases because Agent Tesla is built around harvesting common credential repositories and shipping them out.
Hunting is easier when you anchor on repeatable behaviours. One useful pattern is a new or rarely seen process reading user data locations and then generating network activity shortly after. Another is a workstation that suddenly begins contacting a small set of remote endpoints after a user opens a suspicious attachment. Those combinations are more actionable than any single hash or filename.
For deeper background on the broader stealer ecosystem and post-exposure response patterns, Infostealer Threat Guide is the most relevant internal starting point. If you need adjacent detection context for credential exposure, Tesla Kubernetes cryptojacking 2018 shows how exposed secrets can become an immediate compromise path.
How should teams confirm, scope, and respond to suspected Agent Tesla activity?
Once a hunt hits, confirm whether the suspected host is still collecting or exfiltrating data, and whether the activity is isolated to one user or present across multiple endpoints. The main decision is whether you are dealing with a single infected workstation or a broader phishing campaign with reused lure content and similar execution patterns. That scope determines whether you can contain surgically or need to widen the response.
Because Agent Tesla targets credentials and session material, response should include checking whether exposed accounts were reused elsewhere and whether suspicious outbound sessions line up with the collection window. If the malware touched browser stores, mail data, or FTP credentials, treat those as potentially exposed even before you prove abuse. In practice, that means prioritising credential rotation and session invalidation where the host had access to valuable accounts.
Preserve evidence before cleaning up if you need to understand the entry path or measure blast radius. Memory, process trees, email artefacts, and network logs are often more useful than a single malware sample because they show the sequence of collection and exfiltration. If you only remove the file, you may miss whether the same lure succeeded elsewhere or whether the stolen material already left the environment.
Risk and Threat Considerations
Agent Tesla is dangerous because it turns one successful user execution into a broad disclosure event. The risk is not just malware presence, it is the theft of reusable credentials, mail content, clipboard data, and browser-stored secrets that can be leveraged long after the original endpoint is cleaned.
Failure mechanism: The malware commonly runs in user space, harvests locally available data sources, and then sends the collected material to external infrastructure that may look low-volume or short-lived, which can delay detection.
Impact: A single infected endpoint can expose authenticated access paths, enable account takeover, and create follow-on phishing or lateral movement opportunities if stolen credentials are still valid.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 define the specific risk controls and attack patterns relevant to this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1056.001 — Keylogging | Agent Tesla detection hinges on keystroke capture and data theft behaviour. |
| T1114 — Email Collection | The lure and mail-data access path are central to suspected Agent Tesla activity. | |
| T1555 — Credentials from Password Stores | The question is about detecting credential theft from common local stores. | |
| Recommendation — Correlate keylogging-like process behaviour with follow-on exfiltration and credential access. Hunt for suspicious email-access patterns that precede collection and outbound transfer. Look for access to browser, mail, and other password stores followed by suspicious egress. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Agent Tesla commonly exposes secrets through local harvesting and exfiltration. |
| NHI-07 — Long-Lived Secrets | Stolen credentials remain valuable when sessions and secrets are not short-lived. | |
| Recommendation — Prioritise rotation and containment when stolen secrets may have left the endpoint. Reduce blast radius by shortening secret lifetime and invalidating exposed sessions. | ||
Practitioner Guidance
What to prioritise: Treat the combination of phishing execution, browser or mail data access, and outbound exfiltration as the highest-confidence signal. A filename or hash alone is weaker than a behavioural chain that shows collection followed by transmission.
What to verify: Confirm whether the host accessed credential stores, mail profiles, clipboard content, or FTP artefacts before it connected to unfamiliar command infrastructure. That order matters because it distinguishes active theft from incidental suspicious activity.
Decision rule: If the suspected machine handled business accounts or reused browser sessions, rotate the exposed credentials and invalidate active sessions before you spend time on deep reverse engineering. The operational risk is often in the stolen access, not the binary itself.
Practitioner takeaway: For Agent Tesla, the most useful hunt is behavioural, not signature-only: prove the collection path, prove the exfiltration path, then scope the exposed identities and sessions.