ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of NjRAT remote access trojan components by matching network and host artifacts against a curated set of eleven high-confidence indicators of compromise. Proactively hunting for these specific IOCs within Azure Sentinel is critical to identify early-stage lateral movement or command-and-control communications before they escalate into full-scale data exfiltration incidents.

IOC Summary

Malware Family: NjRAT Total IOCs: 11 IOC Types: sha1_hash, sha256_hash, md5_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NjRAT
let malicious_ips = dynamic(["3.127.181.115", "155.117.183.181"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["3.127.181.115", "155.117.183.181"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["2f299b8f3839e4259a27f4b1d8af0d2473cfe7e0", "1e3fd12fee9d2fd27642ed24cff01338", "a834cec6b236453ee671c23326b60763880a47c93ccc595d6e566ec5f81ade88", "1086e2ec8e9274e1639f14084f27d3b47e606c37ccc2a1e4976db6633ef797d5", "5bc1696dec9c0d82be4ff8910a7ae7c217e9e40e", "2f61cb4b14e0cf839a4a823eceea88e9", "31c37ff61aa322192236c9672f09e3d97b6e6e09c5019077df7d0567d4c0b48b", "33e85ae9412fa870e5d6de31502e7d48c64ce224", "744e1221f6467d0b7e73a10f52e6cd6c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Management Software Updates (e.g., Ivanti, SCCM)

  • Scenario: The organization uses a centralized patch management tool like Ivanti Endpoint Manager or Microsoft SCCM. During scheduled maintenance windows, these tools push updates to remote agents that utilize specific communication channels or hash signatures matching NjRAT’s network beacons. The detection logic may flag the legitimate update traffic as suspicious because it mimics the C2 behavior of the malware.
  • Suggested Filter: Exclude network connections originating from the SCCM/Ivanti Management Point IP ranges and destination ports associated with the software vendor (e.g., Source_IP in [Internal_Mgmt_Range] AND Destination_Port = 443/80).

• Third-Party Remote Support Sessions (e.g., TeamViewer, AnyDesk)

  • Scenario: The IT Help Desk frequently initiates remote support sessions using tools like TeamViewer or AnyDesk. These applications establish persistent connections and execute background processes that share similar process names or file hashes with the NjRAT agent. A scheduled “health check” job running on a user’s workstation could trigger the rule if the tool’s executable hash overlaps with one of the 11 IOCs.
  • Suggested Filter: Create an exclusion for specific executable paths known to be legitimate remote tools (e.g., Process_Path contains "\TeamViewer\TeamViewer.exe" or Process_Name in ["AnyDesk.exe", "TeamViewer_Service"]) and restrict the alert scope to non-admin user sessions during business hours.

• Automated Backup and Sync Operations (e.g., Veeam, OneDrive) *