ThreatFox: MASS Logger IOCs

Hunt Hypothesis

This detection rule identifies adversary activity by correlating three specific Indicators of Compromise (IOCs) from the ThreatFox MASS Logger to uncover potential malicious infrastructure or command-and-control communications. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate compromised assets and prevent lateral movement before the threat escalates, given the high severity associated with these known indicators.

IOC Summary

Malware Family: MASS Logger Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`60bee9be8b1a782592243014d0d0907f3d660241`	payload	2026-08-25	95%
md5_hash	`b980b243307e67831945f3171edd200c`	payload	2026-08-25	95%
sha256_hash	`c522e49fa2f87b3e8e9925555377aa77a42ed9d1790c17b25c2ad052efa96569`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["60bee9be8b1a782592243014d0d0907f3d660241", "b980b243307e67831945f3171edd200c", "c522e49fa2f87b3e8e9925555377aa77a42ed9d1790c17b25c2ad052efa96569"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MASS Logger

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: MASS Logger IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Scheduled Antivirus Definition Updates via Microsoft Endpoint Manager
- Context: The organization uses Microsoft Intune to push daily definition updates. During the update window (e.g., 02:00 AM), the msiexec.exe or SenseClientService.exe process initiates a connection to the MASS Logger IOCs (specifically the update server IP and hash) to download the latest threat intelligence feed, triggering the rule.
- Filter/Exclusion: Create an exclusion based on Process Name (msiexec.exe, SenseClientService.exe) AND Parent Process (IntuneAgent.exe or TaskHost.exe). Additionally, exclude traffic occurring during the defined maintenance window (e.g., 01:00–04:00 UTC).
Scenario: Automated Backup Jobs Executing via Veeam Backup & Replication
- Context: The nightly backup job utilizes a script that queries external threat intelligence APIs to tag backup files with current security metadata. The Veeam.Backup.Service.exe process establishes an outbound HTTPS connection to the MASS Logger API endpoint, matching the specific IOC hash and URL observed in the detection logic.
- Filter/Exclusion: Exclude events where the Source Process is Veeam.Backup.Service.exe running under the Service Account (e.g., DOMAIN\VeeamSvc). Implement a filter to ignore alerts if the destination port is strictly 443 and the user context matches the backup service identity.
Scenario: CI/CD Pipeline Artifact Scanning in Azure DevOps
- Context: During the deployment phase of a critical application,