ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the NetWire RC remote access tool, which is frequently leveraged by threat actors for command and control or lateral movement. The SOC team should proactively search for these signals in Azure Sentinel to identify early-stage infections or active compromises that may evade standard signature-based detections due to the tool’s legitimate appearance.

IOC Summary

Malware Family: NetWire RC Total IOCs: 24 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`6c255ef0b62a23e7828f04054e8f3896`	payload	2026-08-22	95%
md5_hash	`df94520df3d218bd7982a7fc40e92530`	payload	2026-08-22	95%
sha256_hash	`edc73cf039196893ce93018f5fef4057f90a80447c9b7bf55b91a91b423abde1`	payload	2026-08-22	95%
sha1_hash	`22c9f62d38f274eddf7b38a7f63d9d6c926f8c35`	payload	2026-08-22	95%
sha1_hash	`d684d14082b121f32ce1f6b9df8d173d4daee35c`	payload	2026-08-22	95%
sha256_hash	`c6bfb0d885265012930ecd07a5bc2eb2e1c2db218ced4416839af5761f24f927`	payload	2026-08-22	95%
sha256_hash	`99d5dbbcec96cc84ac22c077680420e70315e19703667e5c8d9f2ec76af1acad`	payload	2026-08-22	95%
sha1_hash	`1fba1be772a9cc5ec1359949e28fb1a97fad53de`	payload	2026-08-22	95%
md5_hash	`a67819c12c69894357adbec5d970085d`	payload	2026-08-22	95%
sha1_hash	`0f9aeb923449eec7d1f5f1382c69bebf68cbb908`	payload	2026-08-22	95%
md5_hash	`ee1ed321e64aee5b57ad715a43c23835`	payload	2026-08-22	95%
sha1_hash	`b9826e3da49b12448a57cd37175e01fc776fc38e`	payload	2026-08-22	95%
md5_hash	`9f6cf57a2791b8c53733f410804dcd1a`	payload	2026-08-22	95%
sha256_hash	`355c5ee15bdc6e13d52a6c2551ebffd4932bcb7b93b3f3c7584e6e3a2c420830`	payload	2026-08-22	95%
sha1_hash	`e2a6345a9ab066c8d230f10505e564914ed5fab8`	payload	2026-08-22	95%
md5_hash	`bce4944eabdb55b2b42df2c5a7bd7683`	payload	2026-08-22	95%
sha256_hash	`c2e63d8266f7c297f0303eecb4cb18dd9151ada99c13ca1683794eb8d6db8217`	payload	2026-08-22	95%
sha256_hash	`137d06e4b5009f494fd546fc87eb9fa1dcadf35664cecaeb36416c359f803a86`	payload	2026-08-22	95%
md5_hash	`1a24321c2ee34cabd7b610da455ea11d`	payload	2026-08-22	95%
sha256_hash	`0bdb81149b22afe5219c75aa9679a6a8cb577f9d5659857646b2db7bf3728af1`	payload	2026-08-22	95%
sha1_hash	`c71c4ee0d5a579a86ba59c8d12052c74a9d54aba`	payload	2026-08-22	95%
sha1_hash	`4e76ad7a895a31a99f44a376e364ce0018e04763`	payload	2026-08-22	95%
md5_hash	`b69cc5426070fb399791ce6bdc621049`	payload	2026-08-22	95%
sha256_hash	`b34d9f8bb178e1521ba4d62ee575563872e09153c5741a3f454bfa03083498ad`	payload	2026-08-22	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["6c255ef0b62a23e7828f04054e8f3896", "df94520df3d218bd7982a7fc40e92530", "edc73cf039196893ce93018f5fef4057f90a80447c9b7bf55b91a91b423abde1", "22c9f62d38f274eddf7b38a7f63d9d6c926f8c35", "d684d14082b121f32ce1f6b9df8d173d4daee35c", "c6bfb0d885265012930ecd07a5bc2eb2e1c2db218ced4416839af5761f24f927", "99d5dbbcec96cc84ac22c077680420e70315e19703667e5c8d9f2ec76af1acad", "1fba1be772a9cc5ec1359949e28fb1a97fad53de", "a67819c12c69894357adbec5d970085d", "0f9aeb923449eec7d1f5f1382c69bebf68cbb908", "ee1ed321e64aee5b57ad715a43c23835", "b9826e3da49b12448a57cd37175e01fc776fc38e", "9f6cf57a2791b8c53733f410804dcd1a", "355c5ee15bdc6e13d52a6c2551ebffd4932bcb7b93b3f3c7584e6e3a2c420830", "e2a6345a9ab066c8d230f10505e564914ed5fab8", "bce4944eabdb55b2b42df2c5a7bd7683", "c2e63d8266f7c297f0303eecb4cb18dd9151ada99c13ca1683794eb8d6db8217", "137d06e4b5009f494fd546fc87eb9fa1dcadf35664cecaeb36416c359f803a86", "1a24321c2ee34cabd7b610da455ea11d", "0bdb81149b22afe5219c75aa9679a6a8cb577f9d5659857646b2db7bf3728af1", "c71c4ee0d5a579a86ba59c8d12052c74a9d54aba", "4e76ad7a895a31a99f44a376e364ce0018e04763", "b69cc5426070fb399791ce6bdc621049", "b34d9f8bb178e1521ba4d62ee575563872e09153c5741a3f454bfa03083498ad"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: NetWire RC IOCs detection rule in an enterprise environment:

Scenario 1: Automated Endpoint Security Policy Updates
- Context: The organization’s central management console (e.g., Microsoft SCCM or Ivanti) pushes a scheduled nightly update to all endpoints, which includes downloading configuration files from the NetWire RC vendor repository. This triggers the rule as the system connects to known NetWire IOCs during the update window.
- Filter/Exclusion: Create an exclusion for traffic originating from the specific management server IP (e.g., 10.50.2.15) or exclude connections occurring strictly between 01:00 and 04:00 UTC on weekdays, as these align with the maintenance window.
Scenario 2: Legitimate Remote Support Sessions
- Context: The IT Helpdesk utilizes NetWire RC for remote troubleshooting sessions with end-users or third-party vendors. When a support agent initiates a session to view a user’s desktop or transfer files, the client software establishes connections to NetWire’s relay servers, matching the 24 IOCs in the hunt package.
- Filter/Exclusion: Exclude processes belonging to the specific remote control executable (e.g., NetWireRCAgent.exe or NetWireClientService) running under the context of authorized service accounts (e.g., DOMAIN\HelpDesk_Support).
Scenario 3: Third-Party SaaS Integration via API
- Context: An internal custom application or a CRM system (such as Salesforce or ServiceNow) integrates with NetWire RC to log ticket status updates automatically. This integration involves background API calls that resolve to NetWire’s public IP ranges, triggering the detection logic without indicating malicious activity.