ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the NetWire Remote Access Trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections that may evade standard signature-based detections, thereby preventing potential lateral movement and data breaches within the organization’s cloud infrastructure.

IOC Summary

Malware Family: NetWire RC Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`db967abae63200065e22c95bbc1fe380`	payload	2026-07-31	95%
sha256_hash	`439a03653b8f93d80b15335d49f0937d0f395b803bbf60d6ed31b968816dad39`	payload	2026-07-31	95%
sha1_hash	`7df1fe0e985b0e7ccf3dd4dfa459a3ed20751143`	payload	2026-07-31	95%
sha256_hash	`e3144c24d2eefa8b88c9723c91217f57fb29114a9dbc1ff5f2b0fb4a0183a520`	payload	2026-07-31	95%
sha1_hash	`56426eddd14af3352f475a65af7b7dfb9de2af00`	payload	2026-07-31	95%
md5_hash	`d87b97d9015ba00ef095398f7fbfe4a0`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["db967abae63200065e22c95bbc1fe380", "439a03653b8f93d80b15335d49f0937d0f395b803bbf60d6ed31b968816dad39", "7df1fe0e985b0e7ccf3dd4dfa459a3ed20751143", "e3144c24d2eefa8b88c9723c91217f57fb29114a9dbc1ff5f2b0fb4a0183a520", "56426eddd14af3352f475a65af7b7dfb9de2af00", "d87b97d9015ba00ef095398f7fbfe4a0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, along with targeted filtering strategies:

Scenario: Legitimate Remote Management via Microsoft SCCM/Intune
- Context: Enterprise endpoints running System Center Configuration Manager (SCCM) or Microsoft Intune often utilize remote control sessions to troubleshoot user devices. These tools may establish connections to NetWire RC infrastructure for license validation, policy updates, or telemetry reporting that mimics the IOCs associated with the threat.
- Filter/Exclusion: Exclude traffic originating from specific SCCM site server IP ranges (e.g., 10.20.x.x) or Intune management endpoints where the process name matches ccmexec.exe or Microsoft.IntuneManagementAgent.
Scenario: Scheduled Backup and Monitoring Jobs
- Context: Automated backup solutions (such as Veeam, Commvault, or Rubrik) often schedule nightly jobs that connect to external management consoles. If the NetWire RC IOCs include specific ports or domains used by these vendors for health checks, scheduled tasks running under Veeam.Backup.Service.exe or similar service accounts will trigger alerts during maintenance windows.
- Filter/Exclusion: Create a time-based exclusion for events occurring between 01:00 and 05:00 on weekdays where the source process is identified as a known backup agent, or exclude specific “Service” user contexts (e.g., NT SERVICE\VeeamBackupSvc).
Scenario: Third-Party Security Agent Communication
- Context: Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Carbon Black, or SentinelOne frequently communicate with their cloud gateways. If NetWire RC shares infrastructure or DNS resolution paths with these EDR vendors, the telemetry heartbeat packets from agents like `