ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the NetWire Remote Access Trojan, which is known for establishing persistent backdoors and enabling remote command execution on compromised hosts. A SOC team should proactively search for these IOCs in Azure Sentinel because early identification of NetWire RC presence allows for immediate containment before attackers can leverage its capabilities to exfiltrate sensitive data or pivot across the internal network.

IOC Summary

Malware Family: NetWire RC Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`812c33061b418ef74dc6be4522dc9d7f0efb284d`	payload	2026-07-25	95%
md5_hash	`731219563f05a61e639b645f4892d6cb`	payload	2026-07-25	95%
sha256_hash	`fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["812c33061b418ef74dc6be4522dc9d7f0efb284d", "731219563f05a61e639b645f4892d6cb", "fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario: Endpoint Protection Policy Updates via Central Management Console
- Context: The enterprise utilizes a centralized endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) that periodically pushes updated IOCs from the ThreatFox NetWire RC feed to all agents. This triggers the detection logic as the agent downloads and validates the new hash signatures.
- Filter/Exclusion: Create an exclusion based on the source process name falcon.sys (CrowdStrike) or MsMpEng.exe (Defender). Additionally, filter out events where the destination IP is known internal management server subnets (e.g., 10.20.50.0/24) rather than external public IPs associated with NetWire RC distribution points.
Scenario: Scheduled Vulnerability Scanning Jobs
- Context: A nightly scheduled job runs using a vulnerability scanner like Tenable Nessus or Qualys. During the scan, the agent queries the ThreatFox NetWire RC database to cross-reference local assets against known IOCs, generating network traffic that matches the rule’s hunt package criteria.
- Filter/Exclusion: Exclude events occurring within a specific time window (e.g., 02:00 – 04:00 UTC) where the source process is nessus.exe or qualyspcd. Implement a filter to ignore traffic originating from the dedicated “Scanner VLAN” IP range.
Scenario: Automated Threat Intelligence Ingestion by SIEM
- Context: The organization’s SIEM (e.g., Splunk Enterprise Security or Microsoft Sentinel) runs an automated ingestion pipeline that fetches daily NetWire RC