jRAT configuration

Hunt Hypothesis

This hunt targets adversaries deploying the jRAT remote access tool by identifying specific configuration artifacts that indicate initial command-and-control setup or persistence mechanisms within the environment. Proactively hunting for these configurations in Azure Sentinel is critical because early detection of this low-severity indicator can reveal stealthy lateral movement attempts before they escalate into full-scale data exfiltration incidents.

YARA Rule

rule jRAT_conf : RAT 
{
	meta:
		description = "jRAT configuration" 
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-10-11"
		filetype = "memory"
		version = "1.0" 
		ref1 = "https://github.com/MalwareLu/config_extractor/blob/master/config_jRAT.py" 
		ref2 = "http://www.ghettoforensics.com/2013/10/dumping-malware-configuration-data-from.html" 

	strings:
		$a = /port=[0-9]{1,5}SPLIT/ 

	condition: 
		$a
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the jRAT configuration detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Patch Management Deployment

  • Context: The IT Operations team uses Ansible or SCCM (System Center Configuration Manager) to push a standardized jRAT configuration update to 500+ endpoints during the nightly maintenance window. This triggers the rule due to bulk file modifications and registry writes associated with the agent’s config files (jrat.conf or config.xml).
  • Filter/Exclusion: Create an exclusion based on the Source User Account (e.g., svc_ansible_deploy or SCCM_Admin) combined with a Time-of-Day filter to exclude events occurring between 02:00 and 04:00 UTC.

• Scenario: Endpoint Security Agent Onboarding

  • Context: During the provisioning of new laptops, the Microsoft Intune or Jamf Pro enrollment script automatically installs the jRAT agent and applies a baseline configuration policy to establish remote management capabilities. This generates “configuration change” events immediately upon user login.
  • Filter/Exclusion: Filter out events where the Process Name matches known provisioning scripts (e.g., IntuneManagementExtension.exe, JamfProAgent.sh) and restrict alerts to only trigger if the event originates from a non-standard network segment or an unknown device ID.

• Scenario: Scheduled Log Rotation and Cleanup Job

  • Context: A scheduled Windows Task Scheduler job runs every Sunday morning to rotate jRAT log files and re-apply configuration parameters to ensure compliance with data retention policies. This activity mimics a manual configuration change but is purely automated maintenance.
  • Filter/Exclusion: Implement a rule exclusion