ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of NjRAT remote access trojan indicators to establish persistent command and control channels within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity threat enables rapid containment before attackers can exfiltrate sensitive data or pivot laterally across the environment.

IOC Summary

Malware Family: NjRAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NjRAT
let malicious_ips = dynamic(["158.160.75.185", "185.192.124.218"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.160.75.185", "185.192.124.218"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule, tailored for an enterprise environment:

• Enterprise Antivirus Definition Updates:

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled daily update. During this process, the AV engine downloads and executes a temporary installer or signature pack that shares a specific hash or network destination IP with one of the NjRAT IOCs.
  • Filter/Exclusion: Create an exclusion rule to ignore alerts originating from the known AV service accounts (e.g., SYSTEM, LocalService) and restrict the scope to the specific executable path used by the AV updater (e.g., C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\MpCmdRun.exe).

• Patch Management Deployment Jobs:

  • Scenario: A scheduled task managed by a patch management tool like Ivanti, SCCM (Microsoft Endpoint Configuration Manager), or Ansible executes a deployment script. This script downloads a generic Java Runtime Environment (JRE) or .NET framework installer from a trusted internal repository server that happens to resolve to an IP address matching the NjRAT network IOC.
  • Filter/Exclusion: Exclude traffic and process execution events where the parent process is the patch management agent (e.g., ccmexec.exe for SCCM or ivantsvc.exe) and the destination IP belongs to the internal DMZ range used by the software repository servers.

• Third-Party Remote Support Sessions:

  • Scenario: IT Helpdesk administrators initiate a remote support session using tools like TeamViewer, AnyDesk, or LogMeIn Pro to troubleshoot user workstations. These tools often utilize background services that establish outbound connections to specific cloud endpoints for license