ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Nanocore Remote Access Trojans by monitoring for specific Indicators of Compromise across network and endpoint logs within Azure Sentinel. Proactively hunting for these IOCs is critical to detect early-stage remote access capabilities that could enable lateral movement, credential theft, and persistent command-and-control communication before they escalate into a full-blown breach.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`551aa018350fcf2b435b4d361dd4f117349a5136851f84ac10c02da1526e4e67`	payload	2026-07-05	95%
sha1_hash	`c9970f57910e5e2bb746d838ab0f248bdfa1e15b`	payload	2026-07-05	95%
md5_hash	`2e3bb978d68490c99faac7f590933832`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["551aa018350fcf2b435b4d361dd4f117349a5136851f84ac10c02da1526e4e67", "c9970f57910e5e2bb746d838ab0f248bdfa1e15b", "2e3bb978d68490c99faac7f590933832"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Nanocore RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Endpoint Security Agent Updates & Telemetry
- Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled update or scans specific file hashes that overlap with the Nanocore RAT IOCs. This often occurs when the security vendor includes shared libraries or generic DLLs in their signature database, triggering alerts on legitimate agent communication files.
- Filter/Exclusion: Create an exclusion based on the Process Name and Parent Process. Filter out events where the parent process is the EDR service (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) and the file path matches the known installation directory of the security agent.
IT Asset Management & Patch Deployment Scripts
- Scenario: Automated patch management tools like Microsoft SCCM (Configuration Manager) or Ansible Tower deploy software updates to workstations. These deployment scripts often utilize generic PowerShell cmdlets or batch files that download and execute temporary binaries. If the Nanocore IOCs include common network utility hashes used by these deployment packages, they will trigger during routine maintenance windows.
- Filter/Exclusion: Implement a time-based filter combined with a User Account exclusion. Exclude alerts generated between 02:00 and 05:00 UTC (maintenance window) where the initiating user is a dedicated service account (e.g., svc-patch-deploy or DOMAIN\SCCM-Admin) rather than an interactive human user.
Third-Party Remote Support Sessions
- Scenario: Enterprise helpdesk teams utilize remote support tools such as **Bomgar