ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known indicators of compromise (IOCs) linked to the NetWire Remote Access Trojan, which is frequently used by threat actors to establish persistent backdoors and exfiltrate sensitive data. The SOC team should proactively search for these specific IOCs within Azure Sentinel to identify early-stage infections that may have evaded standard signature-based detections, thereby preventing potential lateral movement and data breaches before they escalate.

IOC Summary

Malware Family: NetWire RC Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`63b7edc9bec5b43b3f012abf34e6c8f7`	payload	2026-08-02	95%
sha256_hash	`226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560`	payload	2026-08-02	95%
sha1_hash	`28af9a5bcfa86426fd4f77313bdb3ce1033410bd`	payload	2026-08-02	95%
sha1_hash	`c463b7913a6e7b03d9c6f9d98a070cd5b97fdd78`	payload	2026-08-02	95%
md5_hash	`5fbf5f42ced3d876ae021839bcc00069`	payload	2026-08-02	95%
sha256_hash	`5a49b31f84002a128f1cd0272619ae3aac4bc4b3065d567daee4300b6ac27a05`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["63b7edc9bec5b43b3f012abf34e6c8f7", "226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560", "28af9a5bcfa86426fd4f77313bdb3ce1033410bd", "c463b7913a6e7b03d9c6f9d98a070cd5b97fdd78", "5fbf5f42ced3d876ae021839bcc00069", "5a49b31f84002a128f1cd0272619ae3aac4bc4b3065d567daee4300b6ac27a05"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, including tailored filters and exclusions:

Scenario 1: Automated Endpoint Protection Updates via Microsoft Defender
- Context: The enterprise utilizes Microsoft Defender for Endpoint (MDE) with an automated update policy. When MDE pulls the latest definition updates or threat intelligence feeds from the cloud, it may initiate network connections to NetWire RC’s distribution servers to fetch specific IOCs or signature files that overlap with the rule’s detection logic.
- Filter/Exclusion: Create a process-based exclusion for MsMpEng.exe (Microsoft Defender Antivirus) and SenseService.exe. Filter out alerts where the source IP belongs to the internal update server range (e.g., 10.x.x.x) or if the user context is SYSTEM during the scheduled maintenance window (e.g., 02:00–04:00 UTC).
Scenario 2: Scheduled Backup Jobs Using Veeam or Commvault
- Context: Legacy backup infrastructure often integrates with external threat intelligence platforms to verify file integrity. A nightly scheduled job in Veeam Backup & Replication might query NetWire RC APIs to validate the security posture of backed-up assets before archiving, triggering network traffic that matches the rule’s IOCs.
- Filter/Exclusion: Exclude alerts generated by the backup service processes Veeam.Backup.Service.exe or CommServe.exe. Implement a time-based filter to suppress alerts occurring strictly during the defined backup window (e.g., 20:00–23:00 local time) for hosts tagged with the “Backup-Server” attribute.
Scenario 3: Admin Manual Threat Intelligence Ingestion via Splunk or QRadar
- Context: Security analysts frequently perform manual