This hunt targets the presence of Nanocore RAT indicators, a remote access tool frequently deployed by threat actors to establish persistent, low-noise control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy backdoors before adversaries leverage them for lateral movement or data exfiltration, reducing the risk of undetected dwell time within the environment.
Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 0c9b60a6e3f6150d984117a1d6edbe27 | payload | 2026-09-25 | 95% |
| sha256_hash | 39da1a494bad2f267e85fa0da9ba6c2387ddf597ebcdf37c2ab257a6a4cbc73e | payload | 2026-09-25 | 95% |
| sha1_hash | 6cbf2b0a20af48e185a88dfdfea0589a8033f354 | payload | 2026-09-25 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["0c9b60a6e3f6150d984117a1d6edbe27", "39da1a494bad2f267e85fa0da9ba6c2387ddf597ebcdf37c2ab257a6a4cbc73e", "6cbf2b0a20af48e185a88dfdfea0589a8033f354"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
nanocore library (or a similarly named internal module) for lightweight task orchestration, causing the process name or file path to match the IOC.
python.exe or pythonw.exe and the working directory is within the application’s virtual environment (e.g., C:\Apps\MyService\venv\), or exclude specific known service accounts running the deployment job.nanocore.log or nanocore.tmp in the %TEMP% or C:\Windows\Temp directories.
\Temp\ or \tmp\ and the file size is less than 1MB, or exclude events initiated by known admin service accounts (e.g., DOMAIN\svc_backup) during scheduled maintenance windows.nanocore.yar or references the string “Nanocore” in its configuration, triggering the string-based IOC.
yara.exe, volatility.exe, floss.exe) or where the user context is a dedicated security analyst account (e.g., DOMAIN\sec_analyst) and the action is limited to read/execute rather than write.