ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of the Nanocore Remote Access Trojan (RAT) by monitoring for specific indicators of compromise across network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to detect early-stage lateral movement and command-and-control communications before the malware establishes persistent access to sensitive resources.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`f85edfbd3b5d8c22774f4239c920727e`	payload	2026-07-10	95%
sha1_hash	`fb85963c2e68338d4f33bdef2ee4020d7f698317`	payload	2026-07-10	95%
sha256_hash	`dacc3d21d8d1e49fd7728f3500943b9eddd80589264d939fbe1fd880fe03938d`	payload	2026-07-10	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["f85edfbd3b5d8c22774f4239c920727e", "fb85963c2e68338d4f33bdef2ee4020d7f698317", "dacc3d21d8d1e49fd7728f3500943b9eddd80589264d939fbe1fd880fe03938d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Nanocore RAT

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Endpoint Detection and Response (EDR) Agent Updates
- Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled nightly update. During this process, the agent downloads and executes a new signature definition pack that includes a shared library component (often a DLL or executable hash) matching one of the Nanocore RAT IOCs. This is common when vendors bundle third-party telemetry libraries into their agents.
- Filter/Exclusion: Create an exclusion for the specific EDR service account (e.g., NT AUTHORITY\SYSTEM or a dedicated svc-falcon-update) and restrict the alert scope to the known installation directory of the EDR agent (e.g., C:\Program Files\CrowdStrike\).
Software Deployment via Configuration Management
- Scenario: The IT Operations team uses a configuration management tool like Ansible, Chef, or Microsoft SCCM/MECM to deploy a new business application across the domain. The deployment package includes a legacy utility tool (such as a specific PDF converter or network diagnostic helper) that shares a binary hash with the Nanocore RAT IOCs. This triggers the rule when the deployment agent executes the installer on thousands of endpoints simultaneously.
- Filter/Exclusion: Exclude execution events originating from the Configuration Management service accounts (e.g., DOMAIN\SCCM-Deploy-Svc or Ansible-Runner) and filter for file paths located within the organization’s standard software distribution folders (e.g., C:\Program Files\AppDeployment\Staging).
Scheduled Administrative Maintenance Scripts
- Scenario: A scheduled PowerShell