ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior where malicious actors deploy the NjRAT remote access trojan to establish persistent command-and-control channels and execute lateral movement within the network. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel because early detection of NjRAT activity is critical to preventing data exfiltration and stopping the initial foothold before it expands across the enterprise environment.

IOC Summary

Malware Family: NjRAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NjRAT
let malicious_ips = dynamic(["64.89.160.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.160.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - NjRAT
let malicious_domains = dynamic(["indigo2forjoy.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule, tailored for an enterprise environment:

• Software Deployment via SCCM/Microsoft Endpoint Configuration Manager

  • Scenario: During a scheduled patch Tuesday cycle, the deployment of the latest version of Ninja One or a specific Java Runtime Environment (JRE) update triggers the NjRAT IOCs. The installation package contains legitimate binaries that share hash signatures or network beaconing patterns with known NjRAT components, particularly when communicating with internal update servers.
  • Filter/Exclusion: Create an exclusion for the specific Process Name (e.g., ccmsetup.exe, msiexec.exe) and Parent Process (CcmExec.exe) originating from the Software Center service account, restricted to the IP range of the internal SCCM Distribution Points.

• Automated Backup Operations with Veeam or Commvault

  • Scenario: The nightly execution of a backup job using Veeam Backup & Replication initiates a remote agent communication task. This task involves establishing persistent connections to backup repositories that utilize network ports and certificate thumbprints overlapping with the NjRAT IOCs, specifically when the backup agent performs integrity checks on archived data files.
  • Filter/Exclusion: Exclude traffic where the Source Process is VeeamAgent.exe or CommServe.exe running under the SYSTEM account, and filter for connections destined to known internal backup subnet CIDR blocks (e.g., 10.20.50.0/24).

• IT Asset Management Scans via Lansweeper

  • Scenario: The enterprise asset management tool, Lansweeper, performs a scheduled deep-scan of endpoints to inventory software and hardware. The