ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of Nanocore Remote Access Trojans (RAT) by detecting six specific Indicators of Compromise across network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications before they escalate into full-scale data exfiltration incidents.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Nanocore RAT
let malicious_ips = dynamic(["154.203.165.5", "154.94.123.43", "154.94.123.42"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.203.165.5", "154.94.123.43", "154.94.123.42"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["036227aa4ccacd6153de68143e02f001", "c1d7ce9290ee9a148ea430871f900a44511b8db374dedcb4d417072b54e48d07", "746b7fc0665654244961885933decb7c3f7dc3a4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Nanocore RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, tailored for an enterprise environment:

• Endpoint Protection Policy Deployment via SCCM/Intune

  • Scenario: The IT security team deploys a new definition update or policy configuration to the endpoint protection agent (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) using System Center Configuration Manager (SCCM). This process often triggers network connections and file writes that match the specific hash signatures or URL patterns of the Nanocore RAT IOCs.
  • Filter/Exclusion: Create an exclusion rule to suppress alerts where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, specifically when communicating with known internal distribution point subnets or Microsoft 365 cloud endpoints.

• Scheduled Software Inventory and Asset Management Scans

  • Scenario: A nightly scheduled job runs a third-party asset management tool (e.g., Lansweeper, ManageEngine Endpoint Central) to inventory installed software and registry keys on domain-joined workstations. The agent’s background scanning module may generate network traffic or file artifacts that overlap with the Nanocore RAT communication patterns defined in the hunt package.
  • Filter/Exclusion: Exclude alerts originating from processes named LansweeperAgent.exe or EndpointCentralAgent.exe during their configured maintenance windows (e.g., 02:00–04:00 local time) and restrict scope to the specific asset management server IP addresses.

• Enterprise Browser Extension Updates

  • Scenario: The organization enforces a mandatory update for security or productivity browser extensions (e.g., Cisco Webex, Zoom for Chrome/Edge, or custom internal SSO plugins). When these extensions auto-update via their background services, they may establish connections to update servers that share