ThreatFox: NjRAT IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects potential compromise by NjRAT, a remote access trojan frequently used by threat actors to establish persistent control and exfiltrate data from Azure environments. Proactively hunting for these IOCs allows the SOC team to identify stealthy intrusions that may evade standard behavioral detections, ensuring rapid containment of high-severity threats before they escalate.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`fb33520062ee28f1137e7704df12871c`	payload	2026-09-05	95%
sha256_hash	`1884032fa01f5483b881248998fc7338979551cf2a1e598dd564cc75a9dd2934`	payload	2026-09-05	95%
sha1_hash	`f24d9b13169f3fa43f09e4ea2abe62c7fe9bffae`	payload	2026-09-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["fb33520062ee28f1137e7704df12871c", "1884032fa01f5483b881248998fc7338979551cf2a1e598dd564cc75a9dd2934", "f24d9b13169f3fa43f09e4ea2abe62c7fe9bffae"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NjRAT

False Positive Guidance

Scenario: A security operations team or incident response (IR) team actively hunting for NjRAT remnants using the same ThreatFox IOC list (e.g., specific file hashes, registry keys, or mutex names) to validate their own detection logic or verify cleanup after a previous incident.
- Filter/Exclusion: Exclude events where the source process is a known hunting tool (e.g., Sysmon.exe, SigmaHQ scripts, Velociraptor, or Falcon agent processes) or where the user account belongs to a SecurityOps or IR group.
Scenario: A legacy application or custom internal tool uses a mutex name or registry key that coincidentally matches one of the NjRAT IOCs (e.g., a generic mutex like Global\NjRAT or a specific registry path used for feature flags).
- Filter/Exclusion: Create a whitelist for specific application binaries (e.g., LegacyApp.exe, InternalTool.dll) or exclude specific registry keys if the path is known to be used by a legitimate, signed application.
Scenario: A software deployment or patching process (e.g., via SCCM, Intune, or a custom PowerShell script) writes a file with a hash matching an NjRAT IOC as part of a temporary staging area or cache, which is later cleaned up but still triggers the alert during the write operation.
- Filter/Exclusion: Exclude file creation events where the parent process is a known deployment agent (e.g., CCMExec.exe, IntuneAgent.exe, powershell.exe running from a specific admin path) and the file path is within a standard temp or staging directory (e.g., C:\Windows\Temp, C:\ProgramData\Deployment).
Scenario: A developer or QA engineer is