ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This detection identifies adversary activity involving the Ghost Remote Access Trojan (RAT) by monitoring for three specific indicators of compromise that signal potential unauthorized remote access and data exfiltration. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly detect stealthy post-exploitation movements, enabling the SOC team to isolate compromised endpoints before attackers establish persistent command-and-control channels or escalate privileges.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`3a05ce5e3eea58d50deb3d12d9f004486cd41efb`	payload	2026-07-31	95%
md5_hash	`f2e641d14aaff8fa4872a157d9d1be82`	payload	2026-07-31	95%
sha256_hash	`69e8a73e215114989a0d9c5c9c666587057e2bcf1c29b1fb7d45e1cb38a715de`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["3a05ce5e3eea58d50deb3d12d9f004486cd41efb", "f2e641d14aaff8fa4872a157d9d1be82", "69e8a73e215114989a0d9c5c9c666587057e2bcf1c29b1fb7d45e1cb38a715de"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Ghost RAT IOCs detection rule in an enterprise environment:

Endpoint Protection Engine Updates
- Scenario: The organization’s primary EDR solution (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs a scheduled daily definition update. During this process, the engine queries the ThreatFox cloud service to fetch the latest IOCs, generating network traffic and file hashes that match the Ghost RAT signatures within the detection logic.
- Filter/Exclusion: Create an exclusion rule targeting the specific EDR service account (e.g., MSSQL$DEFENDER or CrowdStrikeService) and the update process name (MsMpEng.exe or csfalcon.exe). Exclude any events where the source IP is the internal update server or the destination port matches the vendor’s update endpoint.
Scheduled Security Intelligence Feed Ingestion
- Scenario: A centralized SIEM or Threat Intelligence platform (e.g., Splunk Enterprise Security or IBM QRadar) runs a nightly scheduled job to ingest external threat feeds. This job downloads and parses CSV/JSON files containing IOCs from multiple vendors, including ThreatFox. The parsing logic generates file system events that mimic the Ghost RAT IOC structure.
- Filter/Exclusion: Exclude events originating from the SIEM ingestion service account (e.g., svc-siem-ingest) running on dedicated management servers. Add a filter to ignore detections occurring during the specific maintenance window (e.g., 02:00–04:00 UTC) where this scheduled job is active.
IT Asset Management and Discovery Scans
- Scenario: An automated asset discovery tool (such as Lansweeper or ServiceNow Discovery) scans the network to inventory software installations. When scanning for security tools, it