NanoCore

Hunt Hypothesis

This hypothesis posits that adversaries are deploying lightweight, obfuscated payloads identified by the NanoCore YARA signature to establish initial footholds within Azure workloads without triggering high-severity alerts. The SOC team should proactively hunt for these low-fidelity indicators in Azure Sentinel to uncover stealthy reconnaissance or command-and-control activities that might otherwise remain undetected until a more significant compromise occurs.

YARA Rule

rule NanoCore : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/NanoCore"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "NanoCore"
        $b = "ClientPlugin"
        $c = "ProjectData"
        $d = "DESCrypto"
        $e = "KeepAlive"
        $f = "IPNETROW"
        $g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
        $key = {43 6f 24 cb 95 30 38 39}


    condition:
        6 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NanoCore detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Background Scanning by CrowdStrike Falcon

  • Scenario: The CrowdStrike Falcon sensor (specifically the csagent or falcon-sensor.exe process) performs routine file integrity checks on the C:\Program Files\NanoCore directory. This activity triggers the YARA rule because the scanner’s memory footprint and file access patterns mimic the behavior of the NanoCore application itself, often flagging legitimate scanning threads as potential anomalies.
  • Filter/Exclusion: Exclude processes where the parent process name is falcon-sensor.exe or csagent.exe AND the user context is SYSTEM. Additionally, add a path exclusion for any activity originating from the CrowdStrike installation directory (e.g., C:\Program Files\CrowdStrike\).

• Scheduled Patch Deployment via Microsoft SCCM

  • Scenario: During the nightly maintenance window (02:00 AM - 04:00 AM), the System Center Configuration Manager (SCCM) client (ccmexec.exe) executes a scheduled task to deploy updates or configuration changes specifically targeting NanoCore clients across the domain. The deployment agent writes temporary files and modifies registry keys associated with NanoCore, causing the YARA rule to fire on these administrative write operations.
  • Filter/Exclusion: Create an exclusion based on the ccmexec.exe process ID running under the NT AUTHORITY\SYSTEM account during the defined maintenance window (02:00–04:00). Alternatively, filter out events where the command line arguments contain keywords like /update, /deploy, or specific SCCM package IDs related to NanoCore.

• Enterprise Backup Job by Veeam Agent *