ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt targets the presence of NetWire RC, a remote control tool frequently used by adversaries to establish persistent access and execute commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy remote administration channels that may be used for lateral movement or data exfiltration before they are leveraged for further malicious activity.

IOC Summary

Malware Family: NetWire RC Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`265a9ee2d75a71f5512954318179e0c48d4a597c`	payload	2026-09-26	95%
md5_hash	`4745da05e54bdc2439e17423ddd2cfd6`	payload	2026-09-26	95%
sha256_hash	`58d150a4bc026ac1320c18dad149e9a70fd0223377742fa6c5af3fc79ffa47c4`	payload	2026-09-26	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["265a9ee2d75a71f5512954318179e0c48d4a597c", "4745da05e54bdc2439e17423ddd2cfd6", "58d150a4bc026ac1320c18dad149e9a70fd0223377742fa6c5af3fc79ffa47c4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Scenario: Legacy Support Tool Deployment
- Context: IT Support deploys NetWire RC on a small subset of field service laptops or legacy Windows 7/10 endpoints to allow remote assistance for hardware diagnostics. The tool is installed via a custom MSI package and runs as a service or user process, matching the IOCs (e.g., specific binary names, hash values, or registry keys).
- Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or setup.exe and the image path resides in a known support tool directory (e.g., C:\Program Files\NetWire\ or C:\Tools\Support\). Additionally, exclude if the process is running under a dedicated service account (e.g., svc_support) rather than a standard user.
Scenario: Scheduled Maintenance Job
- Context: A scheduled task named “Nightly Remote Sync” uses NetWire RC to push configuration updates or collect logs from remote branch office servers. The task runs daily at 02:00 AM, triggering the IOC detection during the regular maintenance window.
- Filter/Exclusion: Exclude events where the parent process is schtasks.exe or TaskScheduler and the command line contains specific arguments associated with the maintenance script (e.g., /sync or /collect). Alternatively, exclude if the process start time falls within the defined maintenance window (e.g., 01:00–04:00 AM) and the source IP is from the internal management subnet.
Scenario: Development Team Testing Environment
- Context: Developers in the QA team use NetWire RC to test remote control features on virtual machines (VMs) in the development lab. These VMs are not part of the production network but are connected to the same VLAN, causing the IOC to