ThreatFox: ElectroRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity leveraging specific Indicators of Compromise (IOCs) linked to the ElectroRAT remote access tool, which is frequently used by threat actors for command and control operations within compromised networks. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections and potential lateral movement before the malware establishes persistent footholds or exfiltrates sensitive data.

IOC Summary

Malware Family: ElectroRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`c6c0210e1e5828aef772a030ce9a4e93f31c1848`	payload	2026-08-02	95%
md5_hash	`24dc5145757e9f438e801518bc74c0c7`	payload	2026-08-02	95%
sha256_hash	`0ffec6082c9540ac473d603f278168458f574ac9018ba5ed9b7b1e7ec1539133`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ElectroRAT
let malicious_hashes = dynamic(["c6c0210e1e5828aef772a030ce9a4e93f31c1848", "24dc5145757e9f438e801518bc74c0c7", "0ffec6082c9540ac473d603f278168458f574ac9018ba5ed9b7b1e7ec1539133"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ElectroRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: ElectroRAT IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Automated Security Scanning by EDR Agents
- Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background telemetry collection, signature updates, or sandbox analysis. These agents often generate network connections to known security vendor update servers that may share IP addresses or domain hashes with ElectroRAT IOCs.
- Filter/Exclusion: Create a whitelist rule excluding traffic where the Process Name matches specific EDR service executables (e.g., FalconSensorService.exe, MsMpEng.exe) and the destination port is restricted to standard update ports (443, 80) for known vendor IP ranges.
Scenario: Scheduled RMM Tool Maintenance Jobs
- Context: Remote Monitoring and Management (RMM) tools such as NinjaOne, Datto RMM, or ManageEngine Desktop Central run scheduled maintenance jobs during off-hours to patch software or collect inventory data. These tools often utilize generic communication channels that can trigger the ElectroRAT detection logic if their update servers overlap with the rule’s IOCs.
- Filter/Exclusion: Implement a time-based exclusion for alerts generated between 02:00 and 05:00 local time where the Initiating Process belongs to the RMM suite (e.g., NinjaOneAgent.exe, DattoRmmService.exe) and the action is identified as “Scheduled Task” or “Inventory Sync.”
Scenario: Legitimate Remote Support Sessions
- Context: The IT Helpdesk team uses remote support tools