ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This detection rule identifies active communications between internal assets and known NetWire Remote Control infrastructure, signaling potential command-and-control activity from a sophisticated threat actor. Proactive hunting in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent lateral movement before adversaries can establish persistent access or exfiltrate sensitive data.

IOC Summary

Malware Family: NetWire RC Total IOCs: 9 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1cebb153fcb26dcd06614a95276b22a3`	payload	2026-08-04	95%
md5_hash	`6292b4f53c529bdafbb1476e7de48e73`	payload	2026-08-04	95%
sha256_hash	`57e5da8f7c404c1754a866c1f8d51e31f9f21525c17e586ef48eb2a62fa4ef20`	payload	2026-08-04	95%
sha1_hash	`2d7b8391c51937f7c11430a91013a115c315f92f`	payload	2026-08-04	95%
sha256_hash	`a5508bc966bb8d4e0a4275dd96347d84ceecbdb1679fb27ddb4f568fb083faa2`	payload	2026-08-04	95%
sha1_hash	`5a2317b228f48fa8f93665dc6a74fc38888b839a`	payload	2026-08-04	95%
sha1_hash	`de34950c485f3fdaa49687cdd4c71cf6c906774d`	payload	2026-08-04	95%
md5_hash	`78ea9434eb06f6069346be4dc920e706`	payload	2026-08-04	95%
sha256_hash	`0b74552f66e1fb88f401e0c27c9dd224219bc3698a556b8827c392cce5a1bbd3`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["1cebb153fcb26dcd06614a95276b22a3", "6292b4f53c529bdafbb1476e7de48e73", "57e5da8f7c404c1754a866c1f8d51e31f9f21525c17e586ef48eb2a62fa4ef20", "2d7b8391c51937f7c11430a91013a115c315f92f", "a5508bc966bb8d4e0a4275dd96347d84ceecbdb1679fb27ddb4f568fb083faa2", "5a2317b228f48fa8f93665dc6a74fc38888b839a", "de34950c485f3fdaa49687cdd4c71cf6c906774d", "78ea9434eb06f6069346be4dc920e706", "0b74552f66e1fb88f401e0c27c9dd224219bc3698a556b8827c392cce5a1bbd3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: NetWire RC IOCs detection rule in an enterprise environment:

Scenario: Endpoint Protection Scans via Scheduled Tasks
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often run scheduled signature updates or deep scans that trigger the specific hash values associated with NetWire RC components. These legitimate background processes may match the IOCs when they initiate network connectivity to update their local definition databases.
- Filter/Exclusion: Create a filter excluding events where the ProcessName matches known EDR service executables (e.g., FalconSensor.exe, MsMpEng.exe) AND the ParentProcessName is identified as a scheduled task runner (TaskHostW.exe or svchost.exe).
Scenario: Legacy Remote Management Tools
- Context: IT Operations teams frequently utilize remote administration tools like TeamViewer, AnyDesk, or SolarWinds RMM to manage workstations. These tools often embed NetWire RC libraries for their internal communication modules, causing the detection logic to flag legitimate remote session handshakes as potential threats.
- Filter/Exclusion: Exclude alerts where the SourceIP belongs to the internal IT Management VLAN (e.g., 10.x.x.x) and the ProcessImageName contains keywords such as “TeamViewer”, “AnyDesk”, or “SolarWinds”.
Scenario: Automated Patch Deployment via SCCM/Intune
- Context: During monthly patch cycles, System Center Configuration Manager (SCCM) or Microsoft Intune agents push updates that include NetWire RC dependencies. When the agent downloads and installs these components, it generates network traffic patterns identical to the IOCs defined in the rule, triggering false positives on