ThreatFox: MASS Logger IOCs

Hunt Hypothesis

This hunt identifies potential compromises involving the MASS Logger, a tool frequently used by adversaries to capture sensitive data such as credentials and session tokens from web browsers. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect stealthy credential harvesting activities that may bypass traditional network-based detections, thereby reducing the window of opportunity for lateral movement or privilege escalation.

IOC Summary

Malware Family: MASS Logger Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`26c0130537d14afcacdde5779d049d84`	payload	2026-09-21	95%
sha256_hash	`6e81b7f584f9bf03977a97fa1eed6deb1494f4a46a8ce65035a0e4a12e01172b`	payload	2026-09-21	95%
sha1_hash	`e60e309db655ace6222527a896a7286a9efc0696`	payload	2026-09-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - MASS Logger
let malicious_hashes = dynamic(["26c0130537d14afcacdde5779d049d84", "6e81b7f584f9bf03977a97fa1eed6deb1494f4a46a8ce65035a0e4a12e01172b", "e60e309db655ace6222527a896a7286a9efc0696"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — MASS Logger

False Positive Guidance

Legacy Application Maintenance: A specific legacy Java-based ERP system uses a custom logging library that embeds the string MASS_LOGGER in its debug output headers during nightly batch processing jobs.
- Filter/Exclusion: Exclude alerts where the source process is java.exe and the parent process is cmd.exe or a specific service wrapper (e.g., nssm.exe), and the file path matches the known legacy application directory (e.g., C:\Apps\ERP\logs\).
Third-Party Security Agent Updates: The enterprise endpoint protection agent (e.g., CrowdStrike Falcon or Carbon Black) performs a scheduled integrity check that reads or writes temporary files containing IOC strings from its threat intelligence feed, including MASS Logger signatures, into the local cache directory.
- Filter/Exclusion: Exclude alerts where the process name is the known security agent binary (e.g., FalconSensor.exe or CB.exe) and the file path resides within the vendor’s specific cache or temp directory (e.g., C:\ProgramData\CrowdStrike\ or C:\Temp\CB\).
DevOps CI/CD Pipeline Artifacts: A Jenkins or GitLab CI pipeline stage for a microservice project downloads a test fixture or mock data file named mass_logger_sample.json for integration testing, which is then parsed by a Python script.
- Filter/Exclusion: Exclude alerts where the parent process is a CI/CD agent (e.g., jenkins-agent.exe or gitlab-runner.exe) and the file path contains the workspace directory (e.g., C:\Jenkins\workspace\ or /home/gitlab-runner/builds/).
Backup and Restore Operations: A Veeam or Commvault backup job restores a snapshot of a development server where the `MASS