This detection identifies adversary activity involving the Ghost Remote Access Trojan (RAT) by monitoring for specific Indicators of Compromise (IOCs) that signal potential unauthorized remote access and command execution capabilities. Proactively hunting for these IOCs within Azure Sentinel is critical to rapidly identify early-stage infections, enabling the SOC team to isolate compromised endpoints before adversaries can establish persistence or exfiltrate sensitive data.
Malware Family: Ghost RAT Total IOCs: 2 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9 | payload | 2026-09-02 | 90% |
| sha256_hash | bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327 | payload | 2026-09-02 | 90% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9", "bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Ghost RAT IOCs detection rule in an enterprise environment:
Scenario: Security Operations Center (SOC) analysts manually running threat intelligence feeds or importing IOC lists into a SIEM platform like Splunk Enterprise Security or Microsoft Sentinel. When these tools ingest external feeds containing known Ghost RAT signatures, the ingestion process itself triggers the alert as it scans the new IOCs.
SIEM-INGEST-01, THREAT-FEED-SRV) or filter out events generated by specific service accounts used for ingestion (e.g., svc_siem_ingest).Scenario: Automated vulnerability scanning jobs executed by tools such as Tenable Nessus, Qualys Cloud Platform, or Rapid7 InsightVM. These scanners often probe endpoints with known Ghost RAT signatures to verify patch levels or configuration compliance, causing the detection logic to flag the scanner’s own traffic against the target IOCs.
TenableNessus.exe, qualysPCcad.exe) and restrict the scope to exclude traffic originating from the IP subnets designated for vulnerability management infrastructure.Scenario: Scheduled administrative maintenance tasks performed by System Administrators using Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ansible Tower. During routine software deployment or configuration drift checks, admins may deploy Ghost RAT detection agents or update their signatures on endpoints, which generates the specific IOCs monitored by this rule.