ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Nanocore Remote Access Trojan by identifying specific indicators of compromise such as malicious file hashes and network connections. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage lateral movement and command-and-control communications before the RAT establishes a persistent foothold within the enterprise environment.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`3966dfc023858b3f3bd6aca6562964838aaa2e31`	payload	2026-08-13	95%
md5_hash	`7d4dcace32850c5e3e9d5dff5a6ef08d`	payload	2026-08-13	95%
sha256_hash	`4208d5e8fe67a312095ee467a08bd0d6ec6007f10922d03383e760b40e0e1dc9`	payload	2026-08-13	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["3966dfc023858b3f3bd6aca6562964838aaa2e31", "7d4dcace32850c5e3e9d5dff5a6ef08d", "4208d5e8fe67a312095ee467a08bd0d6ec6007f10922d03383e760b40e0e1dc9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Nanocore RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

Scenario: Endpoint Protection Software Updates via Scheduled Tasks
- Context: Enterprise EDR solutions (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) often utilize scheduled tasks to download and install definition updates. These processes frequently generate network traffic matching the Nanocore RAT’s C2 beacon patterns or specific hash signatures used in the hunt package.
- Filter/Exclusion: Create a rule exclusion based on the Process Name (e.g., FalconSensorService.exe, MsMpEng.exe) and Parent Process (Task Scheduler / svchost.exe). Additionally, exclude traffic originating from known update servers or internal patch management systems (e.g., SCCM/Intune endpoints) during defined maintenance windows.
Scenario: Legitimate Remote Desktop Administration
- Context: System administrators frequently use remote management tools like BeyondTrust, Ivanti, or native Windows RDP to perform routine tasks on critical servers. The telemetry generated by these sessions can mimic the interactive session behaviors and specific registry modifications associated with Nanocore RAT, triggering a match on the IOCs related to user interaction and process injection.
- Filter/Exclusion: Implement a filter that excludes alerts where the User Account belongs to the “Domain Admins” or “Helpdesk” groups and the Source IP falls within the internal management subnet (e.g., 10.20.x.x). Furthermore, exclude events where the Process Command Line contains keywords specific to remote tools like /admin, /remote, or rdp.
Scenario: Automated Backup and Archiving Jobs
- Context: Scheduled backup jobs utilizing tools like Vee