This rule detects the presence of known indicators of compromise associated with the MASS Logger, a tool frequently used by adversaries to capture and exfiltrate sensitive data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy logging mechanisms before they are leveraged for data theft or lateral movement, thereby reducing the dwell time of persistent threats within the environment.
Malware Family: MASS Logger Total IOCs: 9 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 352aa5e91d09f8720d6c96a621b4e74fc04d89508ec0a37ef6bb2b53264c4de1 | payload | 2026-09-11 | 95% |
| sha1_hash | 4cffd2c196b97a9cb97c5897db60c219298206b3 | payload | 2026-09-11 | 95% |
| md5_hash | 2fb7862fd236680a78ad8f81e78af336 | payload | 2026-09-11 | 95% |
| sha256_hash | b4a3fbc0f286f44bd854033fc15abebe2206344cc930ff715ae115047d963a09 | payload | 2026-09-11 | 95% |
| sha1_hash | 4e9c93fc20bf8f804b9651dc901addce23b2832e | payload | 2026-09-11 | 95% |
| md5_hash | 8da189f7c2ce6234f1e7ee8f0c33573e | payload | 2026-09-11 | 95% |
| md5_hash | 384aa970109c968fca540791f3c8210c | payload | 2026-09-11 | 95% |
| sha256_hash | 34eb3be967b96e89f6c77a7586e4b21b096a70e985defb4af3fb90053c478dfc | payload | 2026-09-11 | 95% |
| sha1_hash | b6ba31c5afafc545834f66f1eee4e8ff60cd20eb | payload | 2026-09-11 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["352aa5e91d09f8720d6c96a621b4e74fc04d89508ec0a37ef6bb2b53264c4de1", "4cffd2c196b97a9cb97c5897db60c219298206b3", "2fb7862fd236680a78ad8f81e78af336", "b4a3fbc0f286f44bd854033fc15abebe2206344cc930ff715ae115047d963a09", "4e9c93fc20bf8f804b9651dc901addce23b2832e", "8da189f7c2ce6234f1e7ee8f0c33573e", "384aa970109c968fca540791f3c8210c", "34eb3be967b96e89f6c77a7586e4b21b096a70e985defb4af3fb90053c478dfc", "b6ba31c5afafc545834f66f1eee4e8ff60cd20eb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A security team deploys a new endpoint detection and response (EDR) agent or updates an existing one (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) that uses a specific hash or file path matching one of the 9 IOCs to stage its communication service or update binary in a temporary directory.
FalconSensor.exe, MsMpEng.exe, MsSense.exe) or where the file path resides in the vendor-specific installation directory (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\Microsoft Defender\).Scenario: An IT administrator performs a manual software deployment using a tool like SCCM or Intune that downloads and executes a patch or application installer from a trusted internal repository, where the installer’s SHA-256 hash coincidentally matches an IOC due to a shared code library or generic packaging tool.
CCMEXEC.EXE for SCCM, IntuneAgent.exe) or where the file path contains standard deployment directories (e.g., C:\Windows\CCM\, C:\ProgramData\Intune\).Scenario: A developer or QA engineer runs a local test harness or build script that compiles a small C/C++ utility or Python script into an executable, and the resulting binary’s hash or path matches an IOC because it uses a common compiler output pattern or is placed in a standard temp folder like %TEMP% or C:\Users\<user>\AppData\Local\Temp.
cmd.exe, `powershell