ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known NjRAT indicators, a remote access trojan frequently used by threat actors to establish persistent, covert control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy backdoors before they are leveraged for lateral movement or data exfiltration, reducing the dwell time of high-severity threats within the environment.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["54f52128496ccc3cead33a43d9c858344d371be1", "8954631e8ffbb6b865e2353f3d847f0c", "976eb41511fdcb1b13af671b963aca873d1830854c94fa20ea117bdad34d4ce0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

• Scenario: A DevOps engineer uses WinSCP or FileZilla to transfer a large batch of log files to a staging server, where the destination IP address matches a known NjRAT C2 node listed in the ThreatFox IOC set.
  • Filter/Exclusion: Exclude alerts where the source process is a known file transfer client (e.g., winscp.exe, filezilla.exe) and the destination port is standard FTP/SFTP (21, 22) or HTTPS (443) with a high byte count, indicating bulk data transfer rather than small beaconing.
• Scenario: An IT administrator runs a scheduled PowerShell script via Task Scheduler to update internal documentation on a shared drive, and the script temporarily connects to a legacy internal server whose IP has been recently added to the NjRAT IOC list due to a misclassification or reuse of a public IP range.
  • Filter/Exclusion: Exclude connections to IPs within the organization’s internal RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or specific known internal subnets, unless the connection is initiated by a non-standard process (e.g., cmd.exe or powershell.exe from a user profile directory).
• Scenario: A security team performs a manual penetration test or red team exercise, intentionally using a tool like Cobalt Strike or a custom beacon that mimics NjRAT traffic patterns, triggering the IOC match for the C2 IP and user-agent string.
  • Filter/Exclusion: Create a maintenance window exclusion or tag specific source hosts (e.g., red-team-* or pentest-* prefixes in the hostname) as ”