ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Nanocore Remote Access Trojan by identifying specific indicators of compromise such as malicious file hashes and network connections. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain potential remote access compromises that could lead to data exfiltration or lateral movement within the enterprise environment.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`ae5b3e0e621abf17d9f80f51638897cb`	payload	2026-08-02	95%
sha256_hash	`0628a7d09dd681ab6e1d0c904f8c7f2d3fb48183a4a57a7cfeaf4350b01406aa`	payload	2026-08-02	95%
sha1_hash	`c67acc0f58d6f97f0fb07bf54a995cb7268d126b`	payload	2026-08-02	95%
md5_hash	`1a5e935a2545bde844f7aa04d6bce296`	payload	2026-08-02	95%
sha1_hash	`31943eb5d52b7f2af3f21db0a2d078899274033b`	payload	2026-08-02	95%
sha256_hash	`0ec1ed0daf72e7f3b2a9afb44d8e2de77b97b126788e54e0cb948cc176de91ba`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["ae5b3e0e621abf17d9f80f51638897cb", "0628a7d09dd681ab6e1d0c904f8c7f2d3fb48183a4a57a7cfeaf4350b01406aa", "c67acc0f58d6f97f0fb07bf54a995cb7268d126b", "1a5e935a2545bde844f7aa04d6bce296", "31943eb5d52b7f2af3f21db0a2d078899274033b", "0ec1ed0daf72e7f3b2a9afb44d8e2de77b97b126788e54e0cb948cc176de91ba"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Nanocore RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Automated Endpoint Protection Scanning
- Context: The organization’s primary endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) performs scheduled signature updates or heuristic scans. These tools often generate network traffic or process executions that match the specific file hashes or behavioral patterns of Nanocore RAT components, particularly when scanning legacy applications in the C:\Program Files directory.
- Filter/Exclusion: Exclude alerts where the parent process is a known security agent (e.g., FalconSensor.exe, S1Service.exe, or MsMpEng.exe) and the activity occurs during the defined maintenance window (02:00–04:00 local time).
Scenario: Corporate Software Deployment via SCCM/Intune
- Context: The IT operations team uses Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push a new version of a standard enterprise application (e.g., Adobe Acrobat Reader or Zoom) that includes a bundled installer containing libraries similar to Nanocore’s IOCs. During the deployment phase, the installer extracts temporary files and establishes network connections that trigger the detection logic.
- Filter/Exclusion: Create an exclusion rule based on the Process Name of the deployment agent (e.g., ccmsetup.exe, Microsoft.IntuneManagementExtension) and filter out alerts where the file path contains \AppData\Local\Temp\ or \CCMCache\.
Scenario: Scheduled Backup and Archiving Jobs
- Context: Enterprise backup solutions like **Veeam Backup & Replication