ThreatFox: GobRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversaries leveraging the GobRAT backdoor to establish persistent access and execute remote commands within Azure Sentinel environments. Proactive hunting for these IOCs is critical due to the malware’s high severity and its capability to facilitate data exfiltration or lateral movement across compromised endpoints.

IOC Summary

Malware Family: GobRAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`1182e436076f313fb9f22b4cf27918570c50d0ec90fc10d6383a1e86448d68d5`	payload	2026-08-15	95%
sha1_hash	`b55f349e8cd15c07158207942b29d7138ef9c7e0`	payload	2026-08-15	95%
md5_hash	`78cfe8bfbdad19f3afb54cd12d949db4`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GobRAT
let malicious_hashes = dynamic(["1182e436076f313fb9f22b4cf27918570c50d0ec90fc10d6383a1e86448d68d5", "b55f349e8cd15c07158207942b29d7138ef9c7e0", "78cfe8bfbdad19f3afb54cd12d949db4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GobRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: GobRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate RMM Agent Communication
- Context: Remote Management and Monitoring (RMM) tools like ManageEngine Desktop Central, NinjaOne, or PDQ Deploy frequently establish persistent connections to their cloud management gateways. These agents often use similar network ports, user-agent strings, or certificate hashes that overlap with GobRAT’s command-and-control (C2) signatures.
- Filter/Exclusion: Create a whitelist entry for the specific FQDNs of the RMM vendor’s update servers and C2 endpoints. Additionally, exclude traffic originating from known service accounts (e.g., DOMAIN\RMM-Service) running on dedicated management workstations.
Scenario: Scheduled PowerShell Backup Jobs
- Context: Enterprise IT teams often deploy scheduled tasks using PowerShell scripts to perform nightly configuration backups or compliance audits. These scripts may invoke external URLs to upload logs or check for updates, generating network traffic patterns (e.g., specific HTTP POST requests with JSON payloads) that mimic GobRAT’s data exfiltration behavior.
- Filter/Exclusion: Exclude alerts where the process path matches known backup script locations (e.g., C:\Scripts\Backup\DailyLogUploader.ps1) and the user context is a dedicated service account like DOMAIN\Backup-Svc. Implement a filter to ignore events occurring strictly within the defined maintenance window (e.g., 02:00 – 04:00 local time).
Scenario: Endpoint Protection Software Updates
- Context: Major security suites such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne periodically