ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hypothesis targets the presence of NetWire RC, a remote control tool frequently leveraged by adversaries to establish persistent access and execute commands on compromised endpoints. Proactively hunting for these specific IOCs in Azure Sentinel allows the SOC team to identify stealthy remote administration sessions before they are used for lateral movement or data exfiltration.

IOC Summary

Malware Family: NetWire RC Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`6c13dfb410af585f6d03540dd9597ab2`	payload	2026-09-04	95%
sha256_hash	`28d65f871d2b7aabc8fe8a13dfca6a48b2d87a49e80773d9e62cbb955beb0761`	payload	2026-09-04	95%
sha1_hash	`2f0b8f128e364319ca0ae650f2e3cff70470f135`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["6c13dfb410af585f6d03540dd9597ab2", "28d65f871d2b7aabc8fe8a13dfca6a48b2d87a49e80773d9e62cbb955beb0761", "2f0b8f128e364319ca0ae650f2e3cff70470f135"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Legitimate Remote Support Sessions: IT helpdesk or third-party support vendors (e.g., TeamViewer, AnyDesk, or NetWire itself) may use the NetWire client for legitimate remote troubleshooting, triggering the IOCs associated with the client binary or its communication patterns.
- Filter/Exclusion: Exclude processes where the parent process is a known remote support application (e.g., teamviewer.exe, anydesk.exe) or where the user account belongs to a specific “Remote Support” security group.
Software Deployment and Patching: Enterprise configuration management tools (e.g., SCCM, Intune, or PDQ Deploy) may install or update the NetWire client on endpoints as part of a standard software inventory or patching cycle, causing the binary to appear on disk or in memory.
- Filter/Exclusion: Exclude events where the parent process is a known deployment agent (e.g., ccmexec.exe for SCCM, IntuneAgent.exe for Intune) or where the file path resides in standard installation directories like C:\Program Files\NetWire\.
Scheduled Maintenance Tasks: System administrators may create scheduled tasks to periodically check NetWire connectivity or perform automated backups/remote maintenance, which can launch the NetWire client or its associated services.
- Filter/Exclusion: Exclude processes spawned by the Task Scheduler service (svchost.exe with Tasks service) or where the command line arguments include typical maintenance flags (e.g., /maintenance, /check).
Developer or QA Testing Environments: In non-production environments, developers or QA engineers may run NetWire for internal testing, debugging, or performance monitoring, leading to frequent IOC matches that are expected in these isolated zones.
- Filter/Exclusion: Exclude hosts tagged with environment labels such as dev, qa, or `