ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving specific indicators of compromise (IOCs) linked to the NetWire Remote Control malware, which is known for establishing persistent backdoors and enabling remote command execution on compromised endpoints. A SOC team should proactively hunt for these IOCs within their Azure Sentinel environment to rapidly detect early-stage infections and prevent potential lateral movement or data exfiltration before the adversary establishes a foothold in the network.

IOC Summary

Malware Family: NetWire RC Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`812c33061b418ef74dc6be4522dc9d7f0efb284d`	payload	2026-07-25	95%
md5_hash	`731219563f05a61e639b645f4892d6cb`	payload	2026-07-25	95%
sha256_hash	`fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["812c33061b418ef74dc6be4522dc9d7f0efb284d", "731219563f05a61e639b645f4892d6cb", "fda5556e3fa55664509ab396469d00939b0ac6260d01c8cdfbde999ee3a9d0ab"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario 1: Automated Endpoint Protection Updates via Scheduled Tasks
- Context: Enterprise security suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often run scheduled maintenance jobs that pull threat intelligence feeds from external vendors. If “NetWire RC” is a partner or upstream feed provider, the update service may generate network connections matching the rule’s IOCs during peak maintenance windows (e.g., 02:00 AM daily).
- Suggested Filter/Exclusion: Create an exclusion based on Process Name and Schedule. Exclude alerts where ProcessName matches FalconService.exe, MsMpEng.exe, or DefenderUpdate.exe AND the event occurs during the defined maintenance window (e.g., 01:00–04:00 local time).
Scenario 2: Cloud Backup and Disaster Recovery Agents
- Context: Cloud backup solutions like Veeam, Rubrik, or Cohesity often utilize external intelligence services to verify data integrity or check for known ransomware signatures before initiating a backup job. The NetWire RC IOCs may be triggered when these agents query the threat feed during the pre-backup handshake phase.
- Suggested Filter/Exclusion: Implement an exclusion based on Source IP Range and Service Account. Exclude alerts where the source process belongs to known backup service accounts (e.g., VeeamBR.exe, RubrikAgent) running under a dedicated domain account (e.g., DOMAIN\svc-backup-agent) communicating with the specific NetWire RC IP ranges.
Scenario 3: IT Admin Manual Threat Intelligence Review
- Context: