← Back to SOC feed Coverage →

ThreatFox: NetWire RC IOCs

ioc-hunt HIGH ThreatFox
DeviceFileEvents
iocthreatfoxwin-netwire
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-09-08T11:00:00Z · Confidence: high

Hunt Hypothesis

This hypothesis targets the presence of NetWire RC, a remote control tool frequently leveraged by adversaries to establish persistent access and execute commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy remote administration sessions before they are used for lateral movement or data exfiltration.

IOC Summary

Malware Family: NetWire RC Total IOCs: 15 IOC Types: md5_hash, sha1_hash, sha256_hash

TypeValueThreat TypeFirst SeenConfidence
sha1_hash61a32c987ed090c54b7470502bb5a615f121c9e2payload2026-09-0895%
md5_hash0f2e05992e1eb1032016d044b0f93b37payload2026-09-0895%
sha256_hash7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3dapayload2026-09-0895%
sha1_hashab662cb1567b3f5a8114fcfc0f641c8024a4858epayload2026-09-0895%
md5_hashb0a8d7ab2c65b6357c23069a2bf5f777payload2026-09-0895%
sha256_hashd2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3bpayload2026-09-0895%
md5_hash6934255b1ba10cde7a761574d72d4deepayload2026-09-0895%
sha256_hash57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fdpayload2026-09-0895%
sha1_hasha53e7fd746f8b4ccf27f017ce4a56257cd4f9a4fpayload2026-09-0895%
md5_hashd297a3f1b263a489d1742181658cfdcbpayload2026-09-0895%
sha256_hashb19b6070e954271290391cb58e81fb0d2f7f6cbaa88841e2b1161fa66b8d7a10payload2026-09-0895%
sha1_hash628815424b708eb794697b841ff62d8794079122payload2026-09-0895%
md5_hash83235e61c6bdf0d75a1777e0478f2362payload2026-09-0895%
sha256_hash32d22a5e42b2b9fb3d5782103d63b90dc0346358fbaacc1a78102f0d89a277c8payload2026-09-0895%
sha1_hash948500daeb086212459505ff2df662610b4ca554payload2026-09-0895%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["61a32c987ed090c54b7470502bb5a615f121c9e2", "0f2e05992e1eb1032016d044b0f93b37", "7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3da", "ab662cb1567b3f5a8114fcfc0f641c8024a4858e", "b0a8d7ab2c65b6357c23069a2bf5f777", "d2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3b", "6934255b1ba10cde7a761574d72d4dee", "57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd", "a53e7fd746f8b4ccf27f017ce4a56257cd4f9a4f", "d297a3f1b263a489d1742181658cfdcb", "b19b6070e954271290391cb58e81fb0d2f7f6cbaa88841e2b1161fa66b8d7a10", "628815424b708eb794697b841ff62d8794079122", "83235e61c6bdf0d75a1777e0478f2362", "32d22a5e42b2b9fb3d5782103d63b90dc0346358fbaacc1a78102f0d89a277c8", "948500daeb086212459505ff2df662610b4ca554"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://threatfox.abuse.ch/browse/malware/win.netwire/