ThreatFox: RemoteAdmin IOCs

Hunt Hypothesis

This hunt targets the presence of RemoteAdmin, a remote administration tool frequently abused by adversaries to establish persistent access and execute commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify potential backdoors or unauthorized remote sessions before they are leveraged for lateral movement or data exfiltration.

IOC Summary

Malware Family: RemoteAdmin Total IOCs: 5 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`8F096174B0DED0A598F634567C618E12808088848CD07EB99CA4AC57A744CDD9`	payload	2026-09-22	100%
sha256_hash	`D887F20EC383D7CE3A5727856BF7FA68CEB972108B6D0A5DD9924707E820DC24`	payload	2026-09-22	100%
sha256_hash	`87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077`	payload	2026-09-22	100%
sha256_hash	`B7A495F517B9BF23F529552B145121F922AB4915E24B663AE68B3007DAEA3804`	payload	2026-09-22	100%
sha256_hash	`e34c9d3d3a50be99609cc843f91bbfcd0d79853b8c373c5146bcbf77643fb8c2`	payload	2026-09-22	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RemoteAdmin
let malicious_hashes = dynamic(["8F096174B0DED0A598F634567C618E12808088848CD07EB99CA4AC57A744CDD9", "D887F20EC383D7CE3A5727856BF7FA68CEB972108B6D0A5DD9924707E820DC24", "87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077", "B7A495F517B9BF23F529552B145121F922AB4915E24B663AE68B3007DAEA3804", "e34c9d3d3a50be99609cc843f91bbfcd0d79853b8c373c5146bcbf77643fb8c2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — RemoteAdmin

False Positive Guidance

Legacy Application Maintenance: A specific legacy line-of-business application (e.g., an older version of a proprietary ERP or SCADA interface) that bundles the RemoteAdmin client for internal support teams to perform remote troubleshooting. The client is often signed by a third-party vendor and resides in a specific application directory like C:\Program Files\LegacyApp\RemoteAdmin\.
- Filter/Exclusion: Exclude alerts where the process path matches C:\Program Files\LegacyApp\RemoteAdmin\ AND the parent process is the main application executable (e.g., LegacyApp.exe).
Scheduled Backup Verification Job: A scheduled task (schtasks) or PowerShell script executed by the BackupService account that uses the RemoteAdmin CLI tool to verify connectivity and integrity of backup agents on remote servers. The tool is invoked with specific flags like /verify or /status and runs from a standard utility folder.
- Filter/Exclusion: Exclude alerts where the command line contains RemoteAdmin.exe with arguments matching /verify or /status AND the parent process is schtasks.exe or powershell.exe with the working directory located in C:\Scripts\BackupUtils\.
IT Helpdesk Remote Support Session: A Helpdesk technician uses the RemoteAdmin client to connect to a user’s workstation for screen sharing and file transfer during a standard ticket resolution. The client is launched from a standardized IT toolkit folder and connects to a known internal IP range.
- Filter/Exclusion: Exclude alerts where the process path is C:\ITToolkit\RemoteAdmin\RemoteAdmin.exe AND the network connection destination IP is within the internal corporate subnet (e.g., 10.0.0.0/8 or 192.168.0.0/16).
**Development