ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Nanocore Remote Access Trojan by identifying matches against a curated set of twelve specific Indicators of Compromise (IOCs). Proactive hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain stealthy remote access capabilities that could enable lateral movement and data exfiltration within the enterprise network.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 12 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["6e0da4c118ec3a4e2c78f2382c7cf70d", "722635285b6ed905f035850ac097bb619e4f6cf805bbd5d468f053e8f362bcfc", "e8eedbbae67af06f0b7929eb8be036c70015b0ad", "0465401a1bc1b5efbf9d8bd8c3db20a3cc571111", "a0ebe1250b23cb60d919aa4e7dbd7e40", "717d84b07335ef125dd27c00ef3341933ae2a508", "f32f66f210c25ea6dd97348034bb698b", "2055a6d22f882f79211a9209556b9d2e14498da87a112007e5fe0d3bf5cbd2fb", "94c78e0d80e3364e1c90d6f5311e6e4104bfa8e831d3351ba8cb875620d0dc64", "09683b2cb19f16818d0a60264663cac2", "89c3ba702d5c424a14c58c3809897b9fc0a66a84c9e4becd4363972e4077756b", "0b77288fca4555e501c9cb4474cd689bee669c98"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Nanocore RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Security Tool Signature Updates via Scheduled Tasks

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint often run scheduled tasks to fetch threat intelligence updates. If the Nanocore RAT IOCs include specific hash values or network destinations that overlap with the vendor’s update servers, legitimate signature downloads may trigger alerts.
  • Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., C:\Program Files\CrowdStrike\fsquar.exe or C:\Windows\System32\svchost.exe) and restrict the alert to only fire if the process is not running under a known service account (e.g., NT SERVICE\).

• Scenario: Automated Backup Jobs Executing via PowerShell

  • Context: IT Operations teams frequently utilize PowerShell scripts to orchestrate nightly backups using tools like Veeam Backup & Replication or Rubrik. These scripts often invoke network connections and file operations that match the behavioral IOCs of Nanocore RAT, particularly if the script communicates with a specific backup repository IP included in the threat feed.
  • Filter/Exclusion: Filter out alerts where the Parent Process is powershell.exe or pwsh.exe and the command line contains keywords such as -Command, -File, or specific backup tool identifiers (e.g., Veeam.Backup.Service).

• Scenario: Software Deployment via Configuration Management Tools

  • Context: During patching cycles, tools like Microsoft SCCM (Configuration Manager) or Ansible Tower push software packages