ThreatFox: MASS Logger IOCs

Hunt Hypothesis

This hunt targets the presence of known IOCs associated with the MASS Logger, a tool frequently used by adversaries to capture sensitive data such as credentials and session tokens. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised workloads or endpoints before the logger can exfiltrate data or establish persistent access.

IOC Summary

Malware Family: MASS Logger Total IOCs: 2 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["6a341b3e9c265e672ac0bb8c72a7fb2b72f8872a1a12b5d1fa48b868ca43f8b4", "e11f3af65a8ff295858d81d135d49aadb0a157b48b7daffdc34c0c921a29d5ca"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — MASS Logger

False Positive Guidance

• Scenario: A DevOps engineer uses a custom PowerShell script to deploy configuration files to a fleet of Linux servers, where the script includes a base64-encoded string that coincidentally matches one of the MASS Logger IOCs (e.g., a specific hash or string pattern).
  • Filter/Exclusion: Exclude alerts where the source process is powershell.exe or pwsh.exe and the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner, azure-devops-agent) or a standard deployment tool like ansible or chef-client.
• Scenario: A security team runs a periodic integrity check using a tool like clamscan or a custom YARA scanner that loads the MASS Logger IOC list into memory or writes it to a temporary file for matching, triggering the detection on the scanner process itself.
  • Filter/Exclusion: Exclude alerts where the process name is a known scanning tool (e.g., clamscan, yara, osqueryi, falco) or where the command line contains arguments like --scan, --check, or --match.
• Scenario: An application server (e.g., running nginx or apache2) serves a static file (such as a JavaScript bundle or a CSS file) that contains a string matching the IOC, and the detection rule is misconfigured to trigger on file content reads rather than process execution or network connections.
  • Filter/Exclusion: Exclude alerts where the process is a web server daemon (nginx, apache2, httpd, iis) and the operation is a file read (ReadFile) rather than a process creation or network connection.
• Scenario: A database administrator runs a grep or find command across log directories to search for known threat signatures during a