This hunt detects adversary activity involving known NjRAT indicators of compromise to identify potential remote access trojan infections within the environment. Proactive hunting is essential in Azure Sentinel because NjRAT’s stealthy command-and-control capabilities often evade standard signature-based detection, requiring manual investigation to prevent lateral movement and data exfiltration.
Malware Family: NjRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 2f6e93b860cef097c863668b1f38a6f7088bcb77 | payload | 2026-08-02 | 95% |
| md5_hash | b9fbf6f35099d3dd0f984ffb7e027b35 | payload | 2026-08-02 | 95% |
| sha256_hash | 06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e | payload | 2026-08-02 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["2f6e93b860cef097c863668b1f38a6f7088bcb77", "b9fbf6f35099d3dd0f984ffb7e027b35", "06185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are the documented false positive scenarios and corresponding exclusions for the ThreatFox: NjRAT IOCs detection rule:
Scenario: Legitimate deployment of a third-party remote support tool (e.g., TeamViewer, AnyDesk, or Splashtop) by the IT Helpdesk team. These tools often utilize network ports and executable hashes that overlap with known NjRAT indicators, particularly when establishing outbound connections to their update servers or relay nodes.
C:\Program Files\TeamViewer\TeamViewer.exe) and exclude traffic originating from the “IT Helpdesk” Active Directory security group or specific jump-host IP ranges used by support staff.Scenario: Automated software update mechanisms running via Microsoft System Center Configuration Manager (SCCM) or Intune. When these tools push updates for legacy applications that bundle NjRAT-like components, the detection logic may flag the installation service (ccmexec.exe) or the specific installer process as a potential match due to shared certificate chains or network signatures.
ccmexec.exe (SCCM) or Microsoft.Insight.exe (Intune), and add a filter for scheduled tasks named “SoftwareUpdate” running during defined maintenance windows (e.g., 02:00–04:00 UTC).Scenario: Execution of enterprise-grade endpoint protection agents performing routine signature updates. Tools like CrowdStrike Falcon, SentinelOne, or Carbon Black often download definition packs from cloud repositories that share similar TLS fingerprints or file hashes with the NjRAT IOCs, triggering a match during their daily update cycle.