This hunt detects adversary behavior involving the deployment of Nanocore Remote Access Trojan (RAT) by identifying specific Indicators of Compromise (IOCs) that signal unauthorized remote access and potential data exfiltration. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify compromised endpoints and mitigate the high-severity risk posed by this sophisticated malware before it establishes persistence or escalates lateral movement within the network.
Malware Family: Nanocore RAT Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 13[.]248[.]243[.]5:443 | botnet_cc | 2026-08-15 | 100% |
| ip:port | 104[.]234[.]168[.]143:443 | botnet_cc | 2026-08-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Nanocore RAT
let malicious_ips = dynamic(["13.248.243.5", "104.234.168.143"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["13.248.243.5", "104.234.168.143"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:
Scenario: Automated Endpoint Protection Scans by CrowdStrike Falcon
C:\Program Files\Nanocore directory (a legitimate internal utility suite) which triggers network connections to IOCs matching the Nanocore RAT signature.CrowdStrike Falcon Sensor.exe (PID 1024-9999) and the file path contains \Program Files\Nanocore. Alternatively, create a whitelist rule in CrowdStrike for the specific hash of the internal Nanocore utility.Scenario: PowerShell Script Execution by IT Admins
Update-NanoConfig.ps1) that invoke the nanocore-cli.exe tool to push configuration updates, generating traffic patterns identical to the RAT’s command-and-control beacon.powershell.exe and the command line arguments contain -ExecutionPolicy Bypass along with a specific script path (e.g., C:\Scripts\Monthly\Patching\Update-NanoConfig.ps1).Scenario: Scheduled Backup Jobs via Veeam Agent