ThreatFox: NjRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving NjRAT remote access trojan indicators to identify potential command-and-control communications and lateral movement within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because NjRAT’s widespread use by threat actors allows for early detection of persistent threats before they escalate into full-scale data exfiltration or ransomware attacks.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`ff5db489782f10217946f75450803f6c835108c5`	payload	2026-07-25	95%
md5_hash	`0268fde13e99c555ed4a4c6ef193b9ea`	payload	2026-07-25	95%
sha256_hash	`155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["ff5db489782f10217946f75450803f6c835108c5", "0268fde13e99c555ed4a4c6ef193b9ea", "155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NjRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

Scenario: Automated Patch Management Execution
- Context: Enterprise patch management tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti Neurons frequently download and execute remote administration binaries that share hash signatures or network behaviors with NjRAT components. During scheduled maintenance windows, these tools may trigger the detection logic by establishing outbound connections to known update repositories that overlap with NjRAT IOCs.
- Filter/Exclusion: Create a rule exclusion based on the Process Name and User Context. Exclude alerts where ProcessName matches ccmexec.exe (SCCM) or IvantiService.exe AND AccountType is “System” or “Computer Account”. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Remote Desktop and Support Sessions
- Context: Helpdesk teams utilize remote support tools such as TeamViewer, AnyDesk, or LogMeIn Pro to troubleshoot user workstations. These applications often inject dynamic libraries or establish persistent management channels that mimic the telemetry patterns of NjRAT, particularly when connecting to external support servers for session handshakes.
- Filter/Exclusion: Implement a filter based on Parent Process and Destination IP. Exclude alerts where the ParentProcessName is svchost.exe or specific service accounts (e.g., DOMAIN\Helpdesk-Svc) and the destination IP belongs to the known CIDR ranges of the support vendor’s data centers.
Scenario: Scheduled Antivirus Definition Updates