This signature detects the Ncrack brute force tool

Hunt Hypothesis

This detection rule identifies active Ncrack brute force attacks by analyzing network traffic patterns characteristic of this specific enumeration and cracking tool. SOC teams should proactively hunt for these signatures in Azure Sentinel to rapidly identify credential compromise attempts before adversaries successfully enumerate valid accounts or gain unauthorized access.

YARA Rule

rule Ncrack
{
	meta:
		author = "Florian Roth"
		description = "This signature detects the Ncrack brute force tool"
		date = "07/2014"
		score = 60
	strings:
		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Ncrack Brute Force Tool detection rule, including targeted filters and exclusions:

• Scheduled Vulnerability Scanning by Internal Security Team

  • Scenario: The internal security team runs a weekly automated vulnerability assessment using Tenable Nessus or Qualys, which utilizes ncrack as an underlying engine to map network ports and test authentication resilience against known service accounts. This generates high-volume connection attempts that mimic brute force patterns.
  • Filter/Exclusion: Create a whitelist exclusion for the specific IP addresses of the scanning appliances (e.g., 10.50.20.10 and 10.50.20.11) or exclude traffic occurring during the defined maintenance window (e.g., Sundays between 02:00–04:00 UTC).

• Automated Configuration Management via Ansible

  • Scenario: The DevOps team executes an Ansible playbook to deploy configuration updates across a fleet of 500+ Linux servers. The playbook uses ncrack in the background to verify SSH connectivity and validate service availability before pushing changes, triggering rapid sequential connection attempts from the Ansible Control Node.
  • Filter/Exclusion: Exclude traffic originating from the Ansible Controller IP (e.g., 192.168.5.10) where the destination ports are restricted to standard management ports (SSH 22, RDP 3389) and the source user agent string contains “Ansible”.

• Third-Party Cloud Backup Agent Connectivity Checks

  • Scenario: A cloud backup solution like Veeam Backup & Replication or Rubrik performs hourly connectivity health checks on its backup repositories. The agents utilize ncrack to probe