ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity linked to the NetWire RC remote access trojan by correlating network and endpoint telemetry against a curated set of 66 specific indicators of compromise. Proactive hunting for these IOCs in Azure Sentinel is critical to identify early-stage infections that may otherwise evade standard signature-based detections, allowing the SOC team to contain potential lateral movement before data exfiltration occurs.

IOC Summary

Malware Family: NetWire RC Total IOCs: 66 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	873fd304f61c5a036ebeff0ccd79cc659a70e10d	payload	2026-08-07	95%
md5_hash	ac250397bf3f4d207b568c4f40b29f17	payload	2026-08-07	95%
sha1_hash	a1b692780d5727be7643316df9ac66b2e841f288	payload	2026-08-07	95%
md5_hash	3c3cb5457de640745a61405ee4f157a7	payload	2026-08-07	95%
sha256_hash	cd1966788983c1d70afe0055483e3968b1c2951576c2a3a962e808071792d886	payload	2026-08-07	95%
sha256_hash	1e3dd6caa009c9eac37fe6ab54fb27f84e34c48d1c28b2bd93612ba44ae14b93	payload	2026-08-07	95%
sha1_hash	cd94511537ddca34a232b7638e30e0c439e71231	payload	2026-08-07	95%
md5_hash	b89d071659f8f1a5160a08148b34c959	payload	2026-08-07	95%
sha1_hash	b779772c9c9e4b8974ed7a3e01938ee1cdb43ea8	payload	2026-08-07	95%
md5_hash	e4a57306d4d3d0271a3578643693ace9	payload	2026-08-07	95%
sha256_hash	4957dc632215a7500070fa697a4c9439bce4d35d27ab4f62c67f72b8178ca92e	payload	2026-08-07	95%
sha1_hash	837cb1d0bd9b2e0a2e18ec5f257064c8717fb94a	payload	2026-08-07	95%
md5_hash	a4d5724a971bd46250c60267456bdec9	payload	2026-08-07	95%
sha256_hash	feb0d77be627d1f050fd5ff77c1e1c2c2342b79b28a4a629f35875ad0aebb4ac	payload	2026-08-07	95%
sha1_hash	626553675e5f326a8251e880d5032e793382416f	payload	2026-08-07	95%
md5_hash	327a35bb8db59c80c7aca194e04a9578	payload	2026-08-07	95%
sha256_hash	5273b7575eb3efe33117a8209684e11ca42a66ed779ecd32bc9ead5b2a9f0d30	payload	2026-08-07	95%
sha1_hash	5707a2b7c3ce31544b627354182418dafb7307c1	payload	2026-08-07	95%
md5_hash	ad425d7410a864bf63a61ed811a8e77b	payload	2026-08-07	95%
sha256_hash	6c16fb794b6ae6e193e5ca07e5bec0aeeda83d61ddc45f0a66944dde69b210a5	payload	2026-08-07	95%
sha256_hash	f6f133e53b98fc3e0d108357e848f7250ad9fe1b8af75cabe379c03d01e13a81	payload	2026-08-07	95%
sha1_hash	14d696393464aa44bc72199105b825d9ea2a96bb	payload	2026-08-07	95%
md5_hash	1187112573cb0257eeaaddc6e18b36cc	payload	2026-08-07	95%
sha256_hash	add0e262bd554841dc12c106294dda4f8c6b73e7f28fca51a6f57e4d52fa16dc	payload	2026-08-07	95%
sha256_hash	12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["873fd304f61c5a036ebeff0ccd79cc659a70e10d", "ac250397bf3f4d207b568c4f40b29f17", "a1b692780d5727be7643316df9ac66b2e841f288", "3c3cb5457de640745a61405ee4f157a7", "cd1966788983c1d70afe0055483e3968b1c2951576c2a3a962e808071792d886", "1e3dd6caa009c9eac37fe6ab54fb27f84e34c48d1c28b2bd93612ba44ae14b93", "cd94511537ddca34a232b7638e30e0c439e71231", "b89d071659f8f1a5160a08148b34c959", "b779772c9c9e4b8974ed7a3e01938ee1cdb43ea8", "e4a57306d4d3d0271a3578643693ace9", "4957dc632215a7500070fa697a4c9439bce4d35d27ab4f62c67f72b8178ca92e", "837cb1d0bd9b2e0a2e18ec5f257064c8717fb94a", "a4d5724a971bd46250c60267456bdec9", "feb0d77be627d1f050fd5ff77c1e1c2c2342b79b28a4a629f35875ad0aebb4ac", "626553675e5f326a8251e880d5032e793382416f", "327a35bb8db59c80c7aca194e04a9578", "5273b7575eb3efe33117a8209684e11ca42a66ed779ecd32bc9ead5b2a9f0d30", "5707a2b7c3ce31544b627354182418dafb7307c1", "ad425d7410a864bf63a61ed811a8e77b", "6c16fb794b6ae6e193e5ca07e5bec0aeeda83d61ddc45f0a66944dde69b210a5", "f6f133e53b98fc3e0d108357e848f7250ad9fe1b8af75cabe379c03d01e13a81", "14d696393464aa44bc72199105b825d9ea2a96bb", "1187112573cb0257eeaaddc6e18b36cc", "add0e262bd554841dc12c106294dda4f8c6b73e7f28fca51a6f57e4d52fa16dc", "12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58", "0f5f0b2d7a359dd8cb35a8dd4abc31fff4ac6d5e", "8fdc8eb2b0739cdea9e5559342cf9152", "e5c4a6f40f5bbd19f090c1f95626687a", "a43abf1be5dd450dd88370d503721ea3d1b228d06a3ad4957f57a08a73cad669", "84d492bc761bace055e847f34a410f57cd90f53f", "bee0adee9ff4bd8cce13bef4381c5f6dcee3aa25", "fdb6c03e9d9e120f85e827954d55bd88", "1d766b04adda359f3a5b062f6abfc20e1a32e1e4", "683223a69f91887a6cb4f68b50adefb2", "4b1f69dcea99ca1e1884a377ed2481ee1f0d543e7faade27f6ac3dc850042233", "3caaa5e8cab6d0ec2932ea20fb71301eeea20ea16ea18d4cde08f8130a59fd25", "b8bec7b45605da355b092c9f3e40bab447928839d4eef5a9290cb5bb1dd50f2d", "8ffcd01fed2d1735914475f51e33801fd13cceaf", "bab937bd0f559a42ebd338416f5ed99f", "cdf1259459502c82ce1bcb0651d6dba80d6f0bb2c7418e6a4ab75d0c4718536c", "000c5d3519a58d1c7aa14b63b04cea34d1a39ee1", "37af0be3dccc41a28468d76454485b4f", "b5f7df56de192f53a8122e1e6a7d83c80344d94b401d140004cff8cf04252757", "65a8062fbb1555872ba67e696dfc9b67a8a334e4", "455f63ee9d170effdb2305c22977cef8", "60df12c872628826a9a5289474082ffe1ea55819133219dde1d656bdb0d502fd", "e18b8195f4b99f8f4d4b2ab72f52ff479d26b33d", "9f8c1135c656b7b91f1da74cbfee5ea2", "1d9a1b096c4ae71f9c0403802667ea0b3492de2d57281a6d4145ba5758e74bad", "3d927f1e53fcb9d1873527fd760e6910eccd8b21"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — NetWire RC

False Positive Guidance

Here are specific false positive scenarios and corresponding mitigation strategies for the ThreatFox: NetWire RC IOCs detection rule in an enterprise environment:

• Scenario: Scheduled Antivirus or EDR Definition Updates

  • Context: Enterprise endpoints running tools like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection often initiate periodic definition updates. These security agents frequently connect to NetWire RC (or similar threat intelligence feeds) to download the latest IOC lists and signature databases, triggering network connections that match the rule’s IOCs.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific process names of the EDR agent (e.g., MsMpEng.exe, FalconSensorService.exe) or exclude traffic originating from known update server IP ranges associated with the security vendor.

• Scenario: Automated Patch Management and Configuration Drift Checks

  • Context: System administrators utilize tools like Microsoft SCCM (Configuration Manager), Ansible, or SCVMM to run nightly scheduled jobs that validate system configurations against a baseline. These agents may query external threat intelligence repositories via NetWire RC APIs to ensure compliance with current security policies, generating legitimate traffic that matches the detection logic.
  • Filter/Exclusion: Implement an exclusion rule for traffic generated by specific service accounts (e.g., DOMAIN\SCCM-Service-Account) or filter based on the scheduled job name (e.g., “Nightly Compliance Scan”) running within a defined maintenance window (e.g., 02:00 – 04:00 local time).

• Scenario: Cloud Security Posture Management (CSPM) Scans

  • Context: In hybrid environments, cloud security platforms such as Tenable.io, Qualys, or Prisma Cloud perform continuous vulnerability assessments.