detect njRAT in memory

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing njRAT malware to establish persistent command-and-control channels within Azure workloads by executing malicious payloads directly in memory. Proactive hunting for this behavior is critical because, despite its current low severity classification, early identification of njRAT’s in-memory footprint allows the SOC team to mitigate potential data exfiltration and lateral movement before the threat escalates.

YARA Rule

rule Njrat2 {
          meta:
            description = "detect njRAT in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d"

          strings:
            $reg = "SEE_MASK_NOZONECHECKS" wide fullword
            $msg = "Execute ERROR" wide fullword
            $ping = "cmd.exe /c ping 0 -n 2 & del" wide fullword
          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific scenarios where the detect njRAT in memory rule may generate false positives in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Protection Scanning and Injection

  • Scenario: Enterprise EDR agents (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) frequently inject their own monitoring modules into the memory space of critical system processes to hook API calls. These injected DLLs often contain signatures resembling njRAT’s C2 communication libraries, triggering a detection when the EDR scans a user’s browser or Office suite.
  • Filter/Exclusion: Exclude alerts where the parent process is a known EDR service (e.g., csagent.exe, S1Service.exe, MsMpEng.exe) and the injected module path matches the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\).

• Software Deployment and Patching Operations

  • Scenario: Automated deployment tools like Microsoft SCCM, Ivanti, or Ansible execute scripts to push updates. During these tasks, the deployment agent may load custom PowerShell modules or .NET assemblies into memory that utilize similar socket communication patterns as njRAT for reporting status back to the management server.
  • Filter/Exclusion: Create a rule exclusion for processes with specific command-line arguments indicating maintenance mode (e.g., containing /update, /patch, or TaskName=SoftwareDeployment) and restrict detection to non-business hours if these jobs are scheduled nightly.

• Remote Desktop and Virtualization Infrastructure

  • Scenario: In environments using VMware Horizon, Citrix Virtual Apps, or Microsoft Remote Desktop Services (RDS), the host OS injects remote desktop helper processes into user sessions to manage graphics acceleration and input redirection. These helpers