ThreatFox: NjRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the execution of known NjRAT remote access trojan indicators to establish persistent command and control channels within the environment. Proactive hunting for these specific IOCs in Azure Sentinel is critical because NjRAT frequently serves as an initial foothold for attackers, enabling early detection before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`70c24a2bb97c0b995bce9c7cee42d1cc856d177b`	payload	2026-08-07	95%
md5_hash	`ac061db892ad8cd21a565996bdb33d5c`	payload	2026-08-07	95%
sha256_hash	`135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["70c24a2bb97c0b995bce9c7cee42d1cc856d177b", "ac061db892ad8cd21a565996bdb33d5c", "135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NjRAT

False Positive Guidance

Here are three specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Deployment of Remote Management Tools (e.g., AnyDesk, TeamViewer)
- Context: Enterprise IT teams often deploy remote support tools like AnyDesk, TeamViewer, or Splashtop which utilize similar network signatures and process behaviors to NjRAT. These tools frequently establish outbound connections to cloud relay servers that match the NjRAT IOCs (specifically IP ranges or domain hashes).
- Filter/Exclusion: Create a whitelist filter excluding alerts where the Process Name matches known legitimate remote support binaries (e.g., anydesk.exe, TeamViewer_Service.exe) AND the User Account is a member of the “IT-Support” or “HelpDesk” security group. Additionally, exclude traffic originating from specific internal subnets dedicated to the Service Desk team.
Scenario: Scheduled Backup and Agent Heartbeat Jobs
- Context: Enterprise backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect often run scheduled jobs that generate network traffic patterns mimicking NjRAT’s command-and-control (C2) communication. The detection logic may flag the periodic heartbeat packets sent by these agents to their management servers as suspicious IOCs if the destination IPs overlap with ThreatFox intelligence feeds.
- Filter/Exclusion: Implement an exclusion rule based on Scheduled Task Name or Process Command Line. Filter out alerts where the Parent Process is a known backup service (e.g., Veeam.Backup.Service.exe) and the activity occurs during defined maintenance windows (e.g., 02:00–04:00 UTC). Exclude specific destination IPs