ThreatFox: MaskGramStealer IOCs

Hunt Hypothesis

This hunt targets adversary behavior where threat actors deploy the MaskGramStealer malware to exfiltrate sensitive credentials and data from user endpoints via specific known indicators of compromise. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection enables the SOC team to isolate compromised assets before the stealer establishes persistence or expands its lateral movement across the cloud environment.

IOC Summary

Malware Family: MaskGramStealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`2c9cbf61771160a3644e4a4fcbe98dd7`	payload	2026-07-02	95%
sha256_hash	`85e1086d548cfd37e2550a0e74e6540394c555612a79f6afad183a8d7bf3eff4`	payload	2026-07-02	95%
sha1_hash	`eb54c551fb56feff3054a01af9877eb16f6ac09b`	payload	2026-07-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MaskGramStealer
let malicious_hashes = dynamic(["2c9cbf61771160a3644e4a4fcbe98dd7", "85e1086d548cfd37e2550a0e74e6540394c555612a79f6afad183a8d7bf3eff4", "eb54c551fb56feff3054a01af9877eb16f6ac09b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MaskGramStealer

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: MaskGramStealer IOCs rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Security Agent Updates and Signature Synchronization
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled daily update. During this process, the agent downloads and unpacks new definition files that temporarily match one of the MaskGramStealer hash-based IOCs before being verified by the vendor’s internal chain of trust.
- Suggested Filter: Exclude network connections and file creation events originating from the specific service accounts used by the EDR agents (e.g., svc-crowdstrike, Microsoft Defender Antivirus Service) or restrict the rule to trigger only if the process parent is not a known security vendor executable.
IT Administration: Mass Software Deployment via SCCM/Intune
- Scenario: The IT Operations team executes a scheduled deployment of a third-party utility (e.g., a PDF converter or remote access tool) using Microsoft Endpoint Configuration Manager (SCCM) or Intune. The deployment package includes a compressed archive containing the installer, which extracts a shared library file that matches an IOC associated with MaskGramStealer’s resource files.
- Suggested Filter: Create an exclusion for processes spawned by known deployment engines such as ccmexec.exe (SCCM) or IntuneManagementExtension.exe, specifically filtering out file creation events within the standard software distribution folders (e.g., C:\ProgramData\Microsoft\Windows\AppRepository).
Scheduled Backup and Archive Operations
- Scenario: A nightly backup job utilizing Veeam Backup & Replication or Commvault runs across the enterprise. The backup agent reads user home directories to create incremental snapshots, generating temporary staging