ThreatFox: MaskGramStealer IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known MaskGramStealer indicators to identify active credential and data theft campaigns within the environment. A proactive search is essential in Azure Sentinel to rapidly isolate compromised endpoints before attackers can exfiltrate sensitive user credentials or escalate privileges using these specific IOCs.

IOC Summary

Malware Family: MaskGramStealer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`be14447b6480a1e999401100061a9c999992d96ec12eaaa86d796cf486d3db99`	payload	2026-07-25	95%
sha1_hash	`f35652e55ae95e3052466f77f40f50d79e06c1ef`	payload	2026-07-25	95%
md5_hash	`9d15fd606542c103035ec3a3b9ec8da8`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MaskGramStealer
let malicious_hashes = dynamic(["be14447b6480a1e999401100061a9c999992d96ec12eaaa86d796cf486d3db99", "f35652e55ae95e3052466f77f40f50d79e06c1ef", "9d15fd606542c103035ec3a3b9ec8da8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MaskGramStealer

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: MaskGramStealer IOCs detection rule in an enterprise environment:

Scenario: Endpoint Protection Scanning of Quarantine Archives
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) periodically scan quarantined files or update their local definition databases. If the MaskGramStealer IOCs include specific file hashes that match a known benign utility previously flagged and moved to quarantine by the AV engine, the scanner may re-detect these artifacts during its scheduled maintenance window.
- Suggested Filter: Exclude alerts where the Process Name matches known security agents (e.g., FalconSensor.exe, MsMpEng.exe) AND the File Path contains keywords like \Quarantine\ or \Definitions\.
Scenario: Scheduled Backup Jobs Accessing Shared Resource Libraries
- Context: Automated backup solutions (e.g., Veeam, Rubrik) often access shared network drives containing legacy software installers. If a backup job processes a folder containing the specific executable or DLL associated with MaskGramStealer IOCs (perhaps from an old deployment), the backup service account will generate file access events that match the rule’s logic.
- Suggested Filter: Create an exclusion for Process Name matching backup services (e.g., VeeamBackupService.exe, rubrik-agent.exe) running under a dedicated User Account named svc-backup-admin or similar service accounts, specifically when the event type is File Access rather than Execution.
Scenario: Software Deployment via Configuration Management Tools
- Context: IT operations teams use tools like SCCM (Microsoft Endpoint Configuration Manager) or Ansible to push updates. During a deployment cycle, these tools may extract and