This hunt targets the presence of known Nanocore RAT indicators, which are frequently used by threat actors to establish persistent remote access and execute post-compromise actions. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary can leverage the RAT for lateral movement or data exfiltration.
Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 31edc1eef538fdb429601d26422834b3 | payload | 2026-09-24 | 95% |
| sha256_hash | 919f9a20b675968f038bf43c009611a697f11119e037ad577bca4bb2fe746f1c | payload | 2026-09-24 | 95% |
| sha1_hash | 974abebcdf2bfcb5440d9590234b4814318698eb | payload | 2026-09-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["31edc1eef538fdb429601d26422834b3", "919f9a20b675968f038bf43c009611a697f11119e037ad577bca4bb2fe746f1c", "974abebcdf2bfcb5440d9590234b4814318698eb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses a custom PowerShell script to deploy a lightweight monitoring agent (e.g., a modified version of nanocore or a similar Go-based binary) to a fleet of Linux servers for temporary network diagnostics. The binary name or hash matches one of the three IOCs in the hunt package.
/opt/monitoring/, /usr/local/bin/) or exclude processes where the parent process is a known CI/CD runner (e.g., jenkins, gitlab-runner, ansible) and the user is part of the devops or platform-engineering group.Scenario: A security team performs a red team exercise or a tabletop simulation using a known Nanocore sample to validate detection coverage. The sample is executed from a staging server or a dedicated test VM, but the IOC match propagates to production logs if the test VM is not properly isolated or tagged.
10.200.0.0/24) or where the computer name matches a naming convention for test environments (e.g., *LAB*, *TEST*, *SIM*).Scenario: An application server runs a legacy Java or C++ application that bundles a static Nanocore-like library for inter-process communication (IPC) or telemetry. The library is loaded as a DLL/SO file, and its hash matches one of the IOCs, even though it is a signed, known component of the application.