Identify njRat

Hunt Hypothesis

This hypothesis posits that adversaries are deploying njRat remote access trojans to establish persistent footholds within Azure environments by leveraging legitimate system processes for command and control communication. Proactive hunting is essential because njRat’s low-severity footprint often evades standard alerting, requiring manual correlation of behavioral anomalies to detect early-stage lateral movement before data exfiltration occurs.

YARA Rule

rule njrat1: RAT
{
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2015-05-27"
        description = "Identify njRat"
    strings:
        $a1 = "netsh firewall add allowedprogram " wide
        $a2 = "SEE_MASK_NOZONECHECKS" wide

        $b1 = "[TAP]" wide
        $b2 = " & exit" wide

        $c1 = "md.exe /k ping 0 & del " wide
        $c2 = "cmd.exe /c ping 127.0.0.1 & del" wide
        $c3 = "cmd.exe /c ping" wide
    condition:
        1 of ($a*) and 1 of ($b*) and 1 of ($c*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Identify njRat detection rule in an enterprise environment, including suggested filters and exclusions:

• Enterprise Endpoint Management Agent Updates

  • Scenario: The Microsoft Intune or Jamf Pro agent performs a scheduled background update of its core components. This process often involves the creation of temporary executable files (e.g., agent_updater.exe) in the %TEMP% directory that execute with elevated privileges and spawn child processes, mimicking njRat’s initial installation and persistence behaviors.
  • Filter/Exclusion: Create an exclusion for executables located in the specific vendor directories (e.g., C:\Program Files\Microsoft Intune Management Extension\*) or filter by the known SHA-256 hash of the official update installer signed by “Microsoft Corporation” or “Jamf Software.”

• Automated Patch Deployment via SCCM/MECM

  • Scenario: During a nightly maintenance window, System Center Configuration Manager (SCCM) deploys critical security patches. The deployment engine (ccmexec.exe) launches temporary scripts and installers that write to the registry under HKLM\Software and create scheduled tasks for post-installation verification, which can trigger njRat’s “Registry Modification” and “Scheduled Task Creation” logic.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe or TaskSchedulerService.exe running under the NT AUTHORITY\SYSTEM account during the defined maintenance window (e.g., 02:00 – 04:00 local time).

• IT Admin Remote Session Management

  • Scenario: A system administrator uses BeyondTrust (formerly Bomgar) or Citrix Workspace to initiate a remote support session. The agent launches a helper