ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of NjRAT remote access tools by identifying three specific indicators of compromise known to facilitate command and control communications. A SOC team should proactively search for these signatures in Azure Sentinel because early detection of NjRAT activity is critical to preventing lateral movement and data exfiltration before the malware establishes persistent footholds within the network.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["ff5db489782f10217946f75450803f6c835108c5", "0268fde13e99c555ed4a4c6ef193b9ea", "155d1dce8e17b107b531b80b648f1a3fcbcbed764d76a39b0b3972d9424dd2f7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: NjRAT IOCs detection rule:

• Scenario: Internal DevOps Deployment Pipeline Execution

  • Context: The organization uses Jenkins or GitLab CI/CD running on build agents. During nightly builds, these agents download specific Java libraries or deployment artifacts from a trusted internal repository that shares the same hash signature as an NjRAT payload. This is common when the build environment utilizes older versions of libcurl or specific JAR files known to match the rule’s IOCs.
  • Filter/Exclusion: Create a process exclusion for the CI/CD service accounts (e.g., JenkinsService, gitlab-runner) and restrict the detection scope to exclude traffic originating from the dedicated build subnet (e.g., 10.20.50.x). Alternatively, add the specific file hash of the legitimate library to a “Known Good” allowlist within the ThreatFox platform.

• Scenario: Scheduled Enterprise Antivirus Definition Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. A scheduled task named UpdateDefinitions runs daily at 02:00 AM, downloading definition packages from a local distribution server. These packages are often signed by the same certificate authority as NjRAT components and may trigger the IOCs due to overlapping file signatures in the download cache folder.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts for this specific process during the maintenance window (01:30 – 02:30). Additionally, exclude the specific directory path where definitions are cached (e.g., C:\ProgramData\Microsoft\Windows Defender\Platform or the vendor’s equivalent) from the hunt package scope.

• **Scenario: