This hypothesis targets the presence of known Nanocore RAT indicators, which are frequently deployed by threat actors to establish persistent remote access and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary can leverage the RAT for lateral movement, data exfiltration, or further payload delivery.
Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | ed8c27e5acb067148937e6da6e763d32 | payload | 2026-09-06 | 95% |
| sha256_hash | 77da09a95342309e29b441182c91d79ff511f5d35bcfda7aaf5a212b763f589c | payload | 2026-09-06 | 95% |
| sha1_hash | 4e12f2568ed928d24a8e168035040b8ec767abff | payload | 2026-09-06 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["ed8c27e5acb067148937e6da6e763d32", "77da09a95342309e29b441182c91d79ff511f5d35bcfda7aaf5a212b763f589c", "4e12f2568ed928d24a8e168035040b8ec767abff"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
requests or urllib) to poll a public status endpoint or download a configuration file from a third-party SaaS provider (like Jira, Confluence, or a custom internal API) that happens to share the same IP address or domain hash as one of the Nanocore IOCs.
python.exe, node.exe) and the destination port is 80/443, provided the source user belongs to the DevOps or Platform Engineering security group.nmap or Advanced IP Scanner against a range of internal IPs that includes a legacy server or IoT device (e.g., a printer or smart thermostat) which has been assigned a static IP matching a Nanocore IOC.
nmap.exe, ipscan.exe) and the destination is an internal IP range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) with a non-standard port (not 443/80) or a known internal asset tag in the CMDB.rsync, robocopy, or a vendor-specific agent like Veeam or Commvault) connects to a backup repository or cloud storage endpoint (e.g., AWS S3, Azure Blob) that resolves to an IP address listed in the Nanocore