ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Ghost RAT indicators of compromise, which signal a remote access trojan capable of providing adversaries with persistent control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected systems before the threat actor leverages the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`2197b62c1c226bfe4030129622902c9838a345f8`	payload	2026-09-21	95%
md5_hash	`7cc1bd83d32e117bd0ef78d73647c144`	payload	2026-09-21	95%
sha256_hash	`7656ff1c8b9460450225453d8210d394579b0cd02bdad5f1e7be399cc6c06d34`	payload	2026-09-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["2197b62c1c226bfe4030129622902c9838a345f8", "7cc1bd83d32e117bd0ef78d73647c144", "7656ff1c8b9460450225453d8210d394579b0cd02bdad5f1e7be399cc6c06d34"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Scenario: A DevOps engineer uses a standard build automation tool (e.g., Jenkins or GitLab CI) to pull a specific version of a third-party library or dependency that happens to match one of the Ghost RAT hash IOCs due to a shared code base or similar compilation flags.
- Filter/Exclusion: Exclude alerts where the source IP is within the internal CI/CD subnet range (e.g., 10.20.0.0/24) AND the process name is a known build agent (e.g., java.exe, node.exe, msbuild.exe).
Scenario: An IT administrator performs a routine software deployment using SCCM (System Center Configuration Manager) or Intune to push a legacy application update. The installer package contains a DLL or executable that matches a known Ghost RAT IOC because the vendor reused a common component or the file was repacked with a similar header.
- Filter/Exclusion: Exclude alerts where the parent process is CcmExec.exe (SCCM) or IntuneAgent.exe AND the file path resides in the standard software distribution folder (e.g., C:\Windows\CCM\ or C:\Program Files\Intune\).
Scenario: A security team runs a periodic VirusTotal or YARA scan on a backup repository or archive share to validate integrity. The scanning tool (e.g., ClamAV or Malwarebytes) temporarily loads or creates a temporary file in a temp directory that matches an IOC hash, or the scan itself triggers a file creation event that matches the IOC.
- Filter/Exclusion: Exclude alerts where the file path contains \Temp\ or \Tmp\ AND the parent process is a known antivirus or scanning engine (e.g., `clamd.exe