ThreatFox: KrakenKeylogger IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Kraken Keylogger indicators to capture sensitive user input and credentials within the environment. The SOC team should proactively search for these specific IOCs in Azure Sentinel to identify early-stage keylogging activity that could lead to credential theft and unauthorized access before lateral movement occurs.

IOC Summary

Malware Family: KrakenKeylogger Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`3bb888cb49563f907b4b1305cd3c6a1eff227a5a`	payload	2026-08-13	95%
md5_hash	`f0227e480e845b98b91e385b898e9b47`	payload	2026-08-13	95%
sha256_hash	`c9548996fd7c80f449b61ab4706dce3d35307aa7215c8ff82788a513d6789e2d`	payload	2026-08-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - KrakenKeylogger
let malicious_hashes = dynamic(["3bb888cb49563f907b4b1305cd3c6a1eff227a5a", "f0227e480e845b98b91e385b898e9b47", "c9548996fd7c80f449b61ab4706dce3d35307aa7215c8ff82788a513d6789e2d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — KrakenKeylogger

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: KrakenKeylogger IOCs rule, along with suggested filters and exclusions tailored for an enterprise environment:

Endpoint Security Agent Telemetry Collection
- Scenario: The deployed endpoint detection and response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scans the system registry and file system to collect telemetry. This process often generates network traffic or file access events that match the specific IOCs (e.g., specific registry keys or DLL paths) associated with KrakenKeylogger’s persistence mechanisms.
- Filter/Exclusion: Exclude processes where the ProcessName matches FalconSensor.exe, MsMpEng.exe, or DefenderService.exe and the ParentProcessName is a known security service (e.g., svchost.exe with specific service names).
Scheduled Group Policy Updates
- Scenario: During the standard mid-night maintenance window, the System Center Configuration Manager (SCCM) or Microsoft Intune pushes policy updates that modify registry keys related to user input and keyboard hooks. These updates can trigger file creation events on paths identical to those monitored by the KrakenKeylogger rule, specifically when applying keyboard layout configurations.
- Filter/Exclusion: Create a time-based exclusion for alerts occurring between 01:00 and 04:00 local time where the Initiator is identified as “System” or “NT AUTHORITY\SYSTEM” and the action involves registry modification under HKLM\Software\Policies.
Remote Desktop Session Initialization
- Scenario: When an administrator initiates a Citrix Workspace or Microsoft Remote Desktop Services (RDS) session, the client software installs temporary keyboard hook drivers to ensure input synchronization.