ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Ghost Remote Access Trojan by monitoring for six specific indicators of compromise that signal unauthorized remote access and potential data exfiltration. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistent control over critical systems.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7`	payload	2026-08-07	95%
md5_hash	`26f33ae36ad05582393a6d6ec6cb3273`	payload	2026-08-07	95%
sha256_hash	`abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870`	payload	2026-08-07	95%
sha256_hash	`a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144`	payload	2026-08-07	95%
sha1_hash	`99fbd400260206d8480d97d2a1f1b0de9c0bb44b`	payload	2026-08-07	95%
md5_hash	`5b11b38bf0eb3f0952f306ad5be9d5eb`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7", "26f33ae36ad05582393a6d6ec6cb3273", "abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870", "a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144", "99fbd400260206d8480d97d2a1f1b0de9c0bb44b", "5b11b38bf0eb3f0952f306ad5be9d5eb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: Ghost RAT IOCs detection rule in an enterprise environment:

Scenario: Security Tool Updates via Scheduled Tasks
- Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, often utilize scheduled tasks to download definition updates or configuration profiles. These processes may connect to known update servers that share IP addresses or domain hashes with the Ghost RAT IOCs.
- Filter/Exclusion: Create a whitelist rule excluding network connections and process executions originating from specific service accounts (e.g., NT SERVICE\DefSvc) where the parent process is MsMpEng.exe or FalconSensorService.exe. Additionally, exclude known update domains like *.crowdstrike.com or *.microsoftonline.com if they match the IOC list.
Scenario: IT Admin Remote Management Sessions
- Context: System administrators frequently use remote management tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons to push software patches or run scripts across the fleet. The background services of these tools often initiate outbound connections to central management servers that may overlap with Ghost RAT infrastructure, triggering alerts during mass deployment windows.
- Filter/Exclusion: Implement a time-based exclusion for known maintenance windows (e.g., 02:00–04:00 local time) on hosts tagged as “Managed” by SCCM. Alternatively, exclude process executions where the parent process is ccmexec.exe or IvantiAgent.exe, provided the destination IP belongs to the internal DMZ range (e.g., 10.x.x.x).
Scenario: Third-Party Cloud Backup Agents
- Context: Corporate backup solutions such as **Veeam