ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise (IOCs) linked to the NetWire Remote Access Trojan, which is known for establishing persistent backdoors on compromised endpoints. The SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage infections and prevent potential lateral movement or data exfiltration before the malware fully establishes its command-and-control infrastructure.

IOC Summary

Malware Family: NetWire RC Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`d4fd4ff0709271323b8d401579270e6567b6e360`	payload	2026-08-25	95%
md5_hash	`752d5cdda2a1d93d27e38f98a5d23fc2`	payload	2026-08-25	95%
md5_hash	`ab9a2c07b3b1222f5ada4cb7c1fd144e`	payload	2026-08-25	95%
sha256_hash	`f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35`	payload	2026-08-25	95%
sha256_hash	`1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9`	payload	2026-08-25	95%
sha1_hash	`22d5e961804073435cd193c1a4b7d3f4c39a64c4`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["d4fd4ff0709271323b8d401579270e6567b6e360", "752d5cdda2a1d93d27e38f98a5d23fc2", "ab9a2c07b3b1222f5ada4cb7c1fd144e", "f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35", "1404090db3128de503ba4d991a960c7c1bc3b910a62d06ecf7e7081a2fcf11b9", "22d5e961804073435cd193c1a4b7d3f4c39a64c4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate IT Asset Management Scans
- Context: Enterprise asset management tools like ServiceNow Discovery, SolarWinds NCM, or ** Lansweeper** periodically scan network endpoints to inventory hardware and software. These agents often initiate outbound connections to NetWire RC update servers (or similar remote control gateways) to fetch the latest signature definitions, mimicking the IOCs associated with NetWire RC.
- Suggested Filter/Exclusion: Exclude traffic originating from specific Service Accounts (e.g., svc-discovery, svc-inventory) or IP ranges dedicated to the IT Operations VLAN. Additionally, filter out processes where the executable path contains keywords like \Discovery\ or \Agent\.
Scenario: Scheduled Remote Support Maintenance Jobs
- Context: During off-hours (e.g., 2:00 AM – 4:00 AM), automated maintenance scripts using PowerShell or Task Scheduler trigger remote support sessions to patch critical infrastructure. These jobs may invoke the NetWire RC client (NetWireRC.exe or similar) to establish a secure tunnel for configuration backups, triggering the detection logic even though no actual threat actor is present.
- Suggested Filter/Exclusion: Create an exclusion based on Time-of-Day (e.g., 02:00-04:00 UTC) combined with a process parent check. If the parent process is identified as Task Scheduler (svchost.exe or taskscheduler.exe) and the user context is a known local system account, suppress the alert.
Scenario: Third-Party Cloud Backup Synchronization
- Context: