ThreatFox: Nanocore RAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of the Nanocore Remote Access Trojan (RAT) by monitoring for three specific indicators of compromise that enable persistent remote control and data exfiltration. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections before attackers can establish command-and-control channels or access sensitive assets within the cloud environment.

IOC Summary

Malware Family: Nanocore RAT Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`1c250ac3db43c8379591c0a1e8e428b972c1adda38eec2fb46376fb905e0a5e1`	payload	2026-08-30	95%
sha1_hash	`a7306d1131fc113334101d30db8b5b0fa376665b`	payload	2026-08-30	95%
md5_hash	`df436f62af38b7a5bcd8a3368a9f110a`	payload	2026-08-30	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Nanocore RAT
let malicious_hashes = dynamic(["1c250ac3db43c8379591c0a1e8e428b972c1adda38eec2fb46376fb905e0a5e1", "a7306d1131fc113334101d30db8b5b0fa376665b", "df436f62af38b7a5bcd8a3368a9f110a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Nanocore RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Nanocore RAT IOCs detection rule, including recommended filters and exclusions tailored for an enterprise environment:

Scenario: Endpoint Protection Policy Deployment via Microsoft Intune/SCCM
- Context: The IT security team pushes a new configuration profile or application package to the “Nanocore” software suite (often used in specific verticals like healthcare or manufacturing) using Microsoft Endpoint Configuration Manager (SCCM) or Intune. This process triggers network connections and file hashes that match the Nanocore RAT IOCs.
- Filter/Exclusion: Create a rule exception for traffic originating from the internal SCCM Management Point IP range (10.x.x.x) where the destination is the specific “Nanocore” application directory on client machines. Additionally, exclude process executions initiated by ccmexec.exe or msiexec.exe when the parent process is a known system service account (e.g., NT SERVICE\ccm).
Scenario: Scheduled Backup Jobs for Legacy CRM Systems
- Context: A nightly scheduled task runs a legacy Customer Relationship Management (CRM) backup utility that utilizes Nanocore components. The job creates temporary network sessions and writes specific registry keys or files that align with the IOCs defined in the ThreatFox rule, mimicking RAT behavior during peak backup windows (e.g., 02:00–04:00).
- Filter/Exclusion: Implement a time-based exclusion window for the detection logic between 01:30 and 05:00 on weekdays. Furthermore, add an exclusion for process names containing “NanocoreBackup” or specific Service Principal Names (SPNs) associated with the backup service account running these jobs.
**Scenario: Software Update Mechanism for Internal Line