ThreatFox: Shim RAT IOCs

Hunt Hypothesis

This hunt identifies the presence of Shim RAT, a remote access trojan, by matching known indicators of compromise to detect unauthorized remote control capabilities within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical because Shim RAT enables persistent access and lateral movement, allowing adversaries to exfiltrate data or deploy additional payloads before traditional detection mechanisms trigger.

IOC Summary

Malware Family: Shim RAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562`	payload	2026-09-24	95%
sha1_hash	`dd63f54137cd8c2ba7bb43cb6a45db5b2238698c`	payload	2026-09-24	95%
md5_hash	`e629a420112f2bcb593f5467a362a91a`	payload	2026-09-24	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Shim RAT
let malicious_hashes = dynamic(["94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562", "dd63f54137cd8c2ba7bb43cb6a45db5b2238698c", "e629a420112f2bcb593f5467a362a91a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Shim RAT

False Positive Guidance

Scenario: A legacy Java-based enterprise application (e.g., an internal ERP or middleware) uses a custom classloader or shim layer that loads native libraries from a non-standard path (e.g., C:\Program Files\LegacyApp\shims\) which matches the file path or hash IOC.
- Filter/Exclusion: Exclude processes or file paths under specific legacy application directories (e.g., C:\Program Files\LegacyApp\) or allowlist the specific SHA256 hash of the legitimate shim DLL if it is stable across deployments.
Scenario: A DevOps team deploys a custom PowerShell or Python-based “shim” script to bridge an older COM object with a newer .NET framework, placing the script in a temporary or shared network drive location that triggers the path-based IOC.
- Filter/Exclusion: Exclude file paths located in known temporary directories (e.g., C:\Windows\Temp\, C:\Users\Public\) or specific network share mounts (e.g., \\fileserver\devops\shims\) where these bridging scripts are intentionally stored.
Scenario: An automated patching or configuration management tool (e.g., SCCM, Ansible, or Chef) creates a temporary shim executable to execute a specific binary with modified environment variables or arguments, leaving the file on disk briefly during the execution window.
- Filter/Exclusion: Correlate the alert with the parent process being a known configuration management agent (e.g., CCMExec.exe, ansible-service-runner, chef-client) and exclude alerts where the file age is less than 5 minutes or the parent process is in the allowlist of deployment tools.
Scenario: A developer testing a new microservice uses a local “shim” library (a small wrapper DLL) to mock external dependencies during integration