ThreatFox: GovRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known GovRAT indicators of compromise, which are frequently leveraged by threat actors to establish persistent remote access and execute command-and-control operations within enterprise networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, mitigating the risk of lateral movement and data exfiltration before the adversary can fully establish a foothold in the environment.

IOC Summary

Malware Family: GovRAT Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`2a0e7f4e5f72631fbf592d6d1797f512f6c6eda2509aeb8e91f60c237d283720`	payload	2026-09-07	95%
sha1_hash	`413e51015c071ec5b8632c81f64ba833ed6be15a`	payload	2026-09-07	95%
md5_hash	`62d70cdf6d752d0e01c8bffcb46a7643`	payload	2026-09-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - GovRAT
let malicious_hashes = dynamic(["2a0e7f4e5f72631fbf592d6d1797f512f6c6eda2509aeb8e91f60c237d283720", "413e51015c071ec5b8632c81f64ba833ed6be15a", "62d70cdf6d752d0e01c8bffcb46a7643"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — GovRAT

False Positive Guidance

Scenario: A legacy .NET-based internal reporting tool or custom admin utility uses a specific hash (e.g., SHA256: abc123...) for its main executable or a bundled dependency that matches one of the GovRAT IOCs.
- Filter/Exclusion: Exclude the specific file path (e.g., C:\Program Files\InternalTools\ReportGen.exe) or the specific SHA256 hash if it is confirmed to be the legitimate version of the internal tool.
Scenario: An automated software deployment script (using SCCM or Intune) installs a third-party driver or utility that contains a shared library (DLL) with a known GovRAT IOA hash, often due to a common open-source component or a reused build artifact.
- Filter/Exclusion: Exclude the specific process name (e.g., msiexec.exe or setup.exe) when the parent process is a known deployment agent, or exclude the specific file path where the DLL is installed (e.g., C:\Windows\System32\drivers\...).
Scenario: A developer or IT admin runs a local test environment or a CI/CD pipeline agent on a workstation that compiles or executes a test binary that intentionally includes a known IOC hash for testing purposes (e.g., a “canary” file or a test build of a component).
- Filter/Exclusion: Exclude the specific user account (e.g., DOMAIN\dev-qa-01) or the specific directory path (e.g., C:\Users\dev-qa-01\Projects\TestBuilds\) where test artifacts are stored.
Scenario: A backup or snapshot tool creates a temporary copy of a file that matches an IOC hash in a staging directory before moving it to the backup repository, triggering the detection on the temporary