ThreatFox: NetSupportManager RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of NetSupportManager Remote Access Tools (RAT) to establish persistent command-and-control channels and facilitate remote session management within the environment. The SOC team should proactively search for these specific IOCs in Azure Sentinel because unauthorized RAT installations are frequently leveraged by threat actors to maintain long-term access, exfiltrate sensitive data, and execute lateral movements that may bypass standard perimeter defenses.

IOC Summary

Malware Family: NetSupportManager RAT Total IOCs: 13 IOC Types: sha256_hash, url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - NetSupportManager RAT
let malicious_domains = dynamic(["bcrfix.com", "tamweelke.com", "us-addnewdevice.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - NetSupportManager RAT
let malicious_urls = dynamic(["https://us-addnewdevice.com/dl-callback/peevmnpz-psenf5s7-927uja3p-uey4ex9n/setup.msi/e5cdedc2f6f167f2bf343a5bb57aa7f6", "https://pub-f2969eb764264a9280dffa75e6803e93.r2.dev/setup.msi", "http://us-addnewdevice.com/Vzj72DFgvUe1Psg5"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetSupportManager RAT
let malicious_hashes = dynamic(["a9f1e873451adc5be1e9924d876ebaf79a467ab94b3f6a4e27068206f7b52719", "9d7f9ba8bde293ce8fc8b703ea016eda37bdb5726fa2f86f83e70d09fcef919d", "82c64ef8e028f5b58f3a61719792e82bc43fe01f8a6185700ff60b71943d97f9", "a5f7f39121b4fdf1d9dd9c2e8cacdbae1c00cd29383eceeea2cfb3b3a03187c7", "928ccfc1aed294c58960d22ec011f3a6730c1d35cf8d1d5cc54a408326636d32", "4ef9bef04dc4ae1d85773c78249f02f739efcea500ee644e9e200c44340049c2", "6fa62584242262b5da8dab22c790e32cf84adae04d231c09d26aae689547a800"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NetSupportManager RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: NetSupportManager RAT IOCs detection rule, including suggested filters or exclusions tailored for an enterprise environment:

• Scheduled Remote Support Sessions by IT Helpdesk

  • Scenario: The IT Service Desk utilizes NetSupport Manager to conduct scheduled remote troubleshooting sessions with end-users. During these windows (e.g., 9:00 AM – 5:00 PM weekdays), the NetSupportAgent service initiates connections from user workstations to the central management server, triggering IOCs related to outbound traffic and specific process execution hashes.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts for NetSupportManager processes (nsagent.exe, nsmserver.exe) originating from the “Helpdesk” Organizational Unit (OU) or IP subnet during standard business hours, provided the destination is the known internal management server IP.

• Automated Patch Deployment via SCCM/Intune

  • Scenario: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push NetSupport Manager updates and configuration changes overnight. This triggers a scheduled task (NetSupport Update Task) that executes the installer or updater, generating file creation events and network handshakes matching the RAT IOCs.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe (SCCM) or Microsoft.IntuneManagementAgent.exe, specifically when the action occurs between 01:00 and 05:00 UTC, which aligns with the organization’s maintenance window.

• Legacy Server Migration Projects

  • Scenario: During a quarterly server migration project, administrators manually launch NetSupport Manager on legacy Windows Server 2016/2019 instances to monitor real-time performance and assist in data transfer verification. This involves running