ThreatFox: Overlord RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Overlord Remote Access Trojan (RAT) by identifying six specific indicators of compromise that signal potential command-and-control communication or lateral movement within the network. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify and contain this high-severity threat, which is known for its stealthy persistence capabilities and ability to exfiltrate sensitive data before traditional alerts trigger.

IOC Summary

Malware Family: Overlord RAT Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`2d9adcb653a222351652077abc838e027fa814f120741c7fb4f14d71d03f9fa0`	payload	2026-07-25	95%
sha1_hash	`09301281e99e74c52487211f8555571e2b1e9ab9`	payload	2026-07-25	95%
md5_hash	`f3a81cd70d0c86700e45b9de40644c87`	payload	2026-07-25	95%
sha256_hash	`20541efb895ad4079d4dbd7234c661c15b77d67085d67a0582a1b80fa093c16b`	payload	2026-07-25	95%
sha1_hash	`a4e92203d12dba0319d421f67b6a07934e5495a7`	payload	2026-07-25	95%
md5_hash	`f2bc1f451548fadcaa799ab9d46782ba`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Overlord RAT
let malicious_hashes = dynamic(["2d9adcb653a222351652077abc838e027fa814f120741c7fb4f14d71d03f9fa0", "09301281e99e74c52487211f8555571e2b1e9ab9", "f3a81cd70d0c86700e45b9de40644c87", "20541efb895ad4079d4dbd7234c661c15b77d67085d67a0582a1b80fa093c16b", "a4e92203d12dba0319d421f67b6a07934e5495a7", "f2bc1f451548fadcaa799ab9d46782ba"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Overlord RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Overlord RAT IOCs detection rule in an enterprise environment:

Scenario: Legitimate deployment of remote management software where IT administrators use tools like Microsoft Endpoint Configuration Manager (SCCM) or Ivanti Neurons to push updates. These tools often utilize similar network signatures and process execution patterns that overlap with Overlord RAT’s command-and-control behavior, specifically triggering the IOCs related to outbound HTTPS connections on non-standard ports or specific registry key modifications during patch cycles.
- Suggested Filter: Create a whitelist exclusion based on the ProcessName (e.g., ccmsetup.exe, ivantiagent.exe) and restrict the detection scope to exclude traffic originating from known internal IP subnets dedicated to the IT operations group, or filter out events where the user context is a specific service account like DOMAIN\IT-Admin-Svc.
Scenario: Scheduled maintenance jobs executed by backup solutions such as Veeam Backup & Replication or Rubrik. During nightly backup windows, these agents initiate high-volume data transfers and create temporary registry entries for tracking job status. The detection logic may misinterpret the rapid creation of specific registry keys (e.g., under HKLM\Software) and the associated network handshake patterns as Overlord RAT establishing a persistent foothold.
- Suggested Filter: Implement a time-based exclusion window that suppresses alerts between 01:00 AM and 05:00 AM on weekdays, or add an IOC filter to exclude specific file hashes known to belong to the backup agent’s executable (e.g., VeeamAgent.exe) when they are performing write operations to the application directory.
Scenario: Development environments where engineers utilize internal CI/CD pipelines involving Jenkins or GitLab Runners. These runners frequently execute build