ThreatFox: MASS Logger IOCs

Hunt Hypothesis

This detection identifies adversary activity by correlating three specific indicators of compromise (IOCs) from the ThreatFox MASS Logger to uncover potential malicious network communications or file executions. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly validate early-stage threats and mitigate risks before they escalate into broader incidents within the cloud environment.

IOC Summary

Malware Family: MASS Logger Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`9f95f9844c3664d5d417c89f792e4f285b479d5b`	payload	2026-07-25	95%
md5_hash	`b37a599f17c660f832628237aab5eeee`	payload	2026-07-25	95%
sha256_hash	`cda225a090416e0c63da5a077d04b6478a175ef5c668205d70563e0f81717608`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["9f95f9844c3664d5d417c89f792e4f285b479d5b", "b37a599f17c660f832628237aab5eeee", "cda225a090416e0c63da5a077d04b6478a175ef5c668205d70563e0f81717608"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MASS Logger

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: MASS Logger IOCs detection rule:

Scenario 1: Scheduled Backup Operations by Veeam or Commvault
- Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize the mass_logger.exe (or similar service executables) to perform nightly data ingestion and log aggregation. These processes frequently generate network connections to internal repository servers that match the specific IOCs defined in the ThreatFox package, particularly during peak maintenance windows (e.g., 02:00 – 04:00).
- Suggested Filter: Exclude traffic where the source process is VeeamBackup.exe or CommServe.exe and the destination port corresponds to known internal backup repository IPs. Additionally, apply a time-based exclusion for the maintenance window (e.g., 02:00-04:30 UTC).
Scenario 2: Administrative Deployment via Microsoft Endpoint Configuration Manager (SCCM)
- Context: During software deployment cycles, SCCM agents on endpoints may invoke local logging services to track installation progress. If the organization has deployed a custom “MASS Logger” agent as part of its standard imaging or compliance suite, administrative tasks such as policy updates or inventory scans will trigger the rule’s IOCs across hundreds of machines simultaneously.
- Suggested Filter: Create an exclusion for source hosts belonging to the SCCM-Management Active Directory Organizational Unit (OU) where the process name matches ccmexec.exe spawning a child process named mass_logger.
Scenario 3: Automated Compliance Reporting by Splunk or Sentinel
- Context: Centralized SIEM platforms often run scheduled jobs to ingest logs from distributed agents. A specific compliance job might utilize the MASS Logger utility to