Detetcs a certain Nanocore RAT sample

Hunt Hypothesis

This hunt targets adversaries deploying the specific Nanocore Remote Access Trojan to establish persistent command-and-control channels and exfiltrate sensitive data from Azure workloads. Proactively hunting for this signature in Azure Sentinel is critical because early identification of this high-severity RAT allows the SOC team to isolate compromised endpoints before lateral movement occurs, thereby minimizing potential data loss and operational disruption.

YARA Rule

rule Nanocore_RAT_Sample_1 {
	meta:
		description = "Detetcs a certain Nanocore RAT sample"
		author = "Florian Roth"
		score = 75
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
	strings:
		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
		$x3 = "popthatkitty.Resources.resources" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects a certain Nanocore RAT sample” rule in an enterprise environment, including suggested filters and exclusions:

Scenario: Automated Patch Deployment via SCCM
- Context: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager pushes a security update package containing the specific Nanocore binary to thousands of endpoints during the nightly maintenance window. This triggers the rule as the file is extracted and executed on user machines, mimicking the initial infection vector.
- Filter/Exclusion: Create an exclusion based on the Parent Process Name (ccmexec.exe) or the File Hash. Whitelist the specific SHA-256 hash of the known good Nanocore binary used in your patch repository to prevent alerts when SCCM deploys it.
Scenario: IT Helpdesk Remote Support Sessions
- Context: During a ticket resolution, an IT administrator uses a remote support tool (e.g., BeyondTrust, TeamViewer, or LogMeIn) that injects the Nanocore RAT component into the user’s session to facilitate screen sharing and file transfer. The rule detects this injection as a new, potentially malicious sample execution.
- Filter/Exclusion: Implement an exclusion for processes spawned by known remote support executables (e.g., beyondtrust.exe, teamviewer_service.exe). Additionally, filter alerts where the User Account belongs to the IT_Admins security group, as they are authorized to initiate these sessions.
Scenario: Scheduled Antivirus Definition Updates
- Context: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Carbon Black) performs a scheduled daily definition update. This process downloads and unpacks the Nanocore sample as part of its heuristic