ThreatFox: PSLogger IOCs

Hunt Hypothesis

This detection identifies adversary activity involving known PSLogger indicators of compromise (IOCs) that often signal early-stage reconnaissance or lateral movement within an environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical to rapidly identify and contain potential threats before they escalate into broader incidents, leveraging the high severity nature of PSLogger-based attacks.

IOC Summary

Malware Family: PSLogger Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`88e1e1c77f64a17500d8569ee43b7a28`	payload	2026-08-04	95%
sha1_hash	`a7397cad1aabe9ce156087682cb67e79b49441fe`	payload	2026-08-04	95%
sha256_hash	`fdd20fd8b01a168bc84fca30eb3c29176a770f173318368abd6ca09d37901480`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - PSLogger
let malicious_hashes = dynamic(["88e1e1c77f64a17500d8569ee43b7a28", "a7397cad1aabe9ce156087682cb67e79b49441fe", "fdd20fd8b01a168bc84fca30eb3c29176a770f173318368abd6ca09d37901480"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — PSLogger

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: PSLogger IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Compliance Reporting via PowerShell
- Context: The IT Security team runs a nightly scheduled task using PowerShell to query Active Directory and export user access logs to a CSV file stored on the file server. This process triggers the PSLogger IOCs as it iterates through directory objects, mimicking the behavior of threat hunting scripts.
- Filter/Exclusion: Create an exclusion rule based on the Scheduled Task Name (e.g., Daily_AD_Compliance_Report) and restrict the detection to exclude processes running under the specific service account svc_compliance during business hours (08:00–18:00).
Scenario: Endpoint Configuration via SCCM/Intune
- Context: Microsoft Endpoint Manager (formerly SCCM) or Intune pushes a configuration policy to update registry keys on 5,000+ workstations. The deployment agent executes a PowerShell script that utilizes PSLogger modules to audit the changes before applying them, generating the specific IOCs associated with this rule.
- Filter/Exclusion: Exclude events where the parent process is ccmexec.exe (SCCM) or MsMpEng.exe (Intune agent). Additionally, filter by the command line argument containing /PolicyId to distinguish automated deployments from manual administrative sessions.
Scenario: DevOps CI/CD Pipeline Execution
- Context: The internal Azure DevOps server runs a nightly build pipeline that includes a stage for “Infrastructure as Code” validation. This stage invokes PowerShell scripts on the build agents (running Windows Server 2019) to validate network configurations, which triggers the PSLogger IOCs due to high