ThreatFox: HabitsRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of HabitsRAT remote access trojan by monitoring for specific indicators of compromise such as malicious file hashes and network connections. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections that could lead to credential theft, lateral movement, or data exfiltration before they escalate into a full-blown incident.

IOC Summary

Malware Family: HabitsRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`676a249f36ca2fe67297e167f622679023b4f474c634c690a7db96d75a00d8ad`	payload	2026-08-25	95%
sha1_hash	`1d5c6e845ea6044dff2e504621e578cadadf7984`	payload	2026-08-25	95%
md5_hash	`b2b14596a08d505ce385c914c6a971f8`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - HabitsRAT
let malicious_hashes = dynamic(["676a249f36ca2fe67297e167f622679023b4f474c634c690a7db96d75a00d8ad", "1d5c6e845ea6044dff2e504621e578cadadf7984", "b2b14596a08d505ce385c914c6a971f8"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — HabitsRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: HabitsRAT IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

Scenario 1: Scheduled Antivirus Scans in R&D Departments
- Context: The Research & Development team uses a mix of legacy and modern endpoints where the internal EDR (e.g., CrowdStrike Falcon or Microsoft Defender) performs nightly deep scans. These scans often generate network traffic to known update servers that share IP ranges or hash signatures with HabitsRAT’s Command & Control (C2) infrastructure, triggering the rule when the scan connects to a specific IOCs list.
- Filter/Exclusion: Create an exclusion based on the ProcessName of the security agent (e.g., FalconSensor.exe or MsMpEng.exe) and filter out alerts where the SourceIP belongs to the internal update subnet range (e.g., 10.50.x.x).
Scenario 2: Automated Software Deployment via SCCM/Intune
- Context: The IT Operations team runs a scheduled job using Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy a specific productivity suite (e.g., Adobe Creative Cloud or Zoom). The deployment package includes a background service that establishes persistent connections to external licensing servers which match the HabitsRAT IOCs, causing the rule to fire during the deployment window.
- Filter/Exclusion: Implement a time-based exclusion for alerts occurring between 01:00 and 05:00 UTC on weekdays, combined with an exclusion for CommandLine arguments containing specific keywords like /deploy, /install, or the publisher name of the deployment tool (e.g., Microsoft Corporation).
Scenario 3: Cloud Backup Agents Connecting to Vendor Gateways