ThreatFox: MASS Logger IOCs

Hunt Hypothesis

This hunt targets the presence of known IOCs associated with the MASS Logger, a tool frequently used by adversaries to establish persistent access and exfiltrate sensitive data. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage compromise and prevent attackers from leveraging this logger to maintain a foothold within the environment.

IOC Summary

Malware Family: MASS Logger Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`4596d056742f9a49681e761df56d68fe20ba3c18`	payload	2026-09-05	95%
md5_hash	`9ca08f91e852044c9b247e09950b11b3`	payload	2026-09-05	95%
sha256_hash	`059ddcc503fe7484565b349b123b4e6b0438896dbeb0124b85f3ac504d8d67a0`	payload	2026-09-05	95%
sha256_hash	`845f66b5b5484651e5978daa62d0d227d433ad0c203f9711b099234381afa9d4`	payload	2026-09-05	95%
sha1_hash	`4c610125ada26f5d3603aac6f828c2305e9f5f18`	payload	2026-09-05	95%
md5_hash	`ec75a5bf2271f02cc3079d4181b1443e`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["4596d056742f9a49681e761df56d68fe20ba3c18", "9ca08f91e852044c9b247e09950b11b3", "059ddcc503fe7484565b349b123b4e6b0438896dbeb0124b85f3ac504d8d67a0", "845f66b5b5484651e5978daa62d0d227d433ad0c203f9711b099234381afa9d4", "4c610125ada26f5d3603aac6f828c2305e9f5f18", "ec75a5bf2271f02cc3079d4181b1443e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MASS Logger

False Positive Guidance

Scenario: A DevOps engineer uses a standard logging utility like logrotate or systemd-journald to manage application logs, where the specific hash or path pattern matches one of the MASS Logger IOCs (e.g., a generic logger binary or a specific log file location).
- Filter/Exclusion: Exclude processes where the parent process is logrotate, systemd, or cron, or filter out known service accounts (e.g., svc-logging, app-service) that are expected to write to these specific paths.
Scenario: An IT administrator runs a backup or archival job using tools like Veeam, Acronis, or rsync that temporarily creates log files or uses a helper binary matching the IOC hash in a standard temp directory (/tmp, C:\Windows\Temp).
- Filter/Exclusion: Exclude events where the process name is rsync, vssadmin, or backup-agent, and the file path contains standard backup directories (e.g., \\backup-server\, /var/backup/, C:\Backup\).
Scenario: A security team performs a vulnerability scan or integrity check using tools like Nessus, Qualys, or OpenSCAP, which may drop temporary logger binaries or create log artifacts that match the IOC signatures.
- Filter/Exclusion: Exclude processes initiated by known scanning tools (e.g., nessusd, qualys_agent, openscapd) or filter out user accounts with specific group memberships (e.g., SecurityTeam, ScanService).
Scenario: A CI/CD pipeline (e.g., Jenkins, GitLab CI, Azure DevOps) executes build steps that generate build logs or use a custom logger script in the workspace directory, which may match