ThreatFox: Overlord RAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of Overlord Remote Access Trojan (RAT) by identifying specific indicators of compromise such as malicious file hashes and network connections. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly identify active RAT infections that could enable long-term persistence, credential theft, and lateral movement within the enterprise environment.

IOC Summary

Malware Family: Overlord RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`02e0b6dd34553b2d1e4a0f023716061884893d84995b3641b388b02f4e04014d`	payload	2026-08-25	95%
sha1_hash	`432fb29714e78ea2d8e8e907132bc7259d445cb4`	payload	2026-08-25	95%
md5_hash	`553f64001e0e802a9619bd934d791155`	payload	2026-08-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Overlord RAT
let malicious_hashes = dynamic(["02e0b6dd34553b2d1e4a0f023716061884893d84995b3641b388b02f4e04014d", "432fb29714e78ea2d8e8e907132bc7259d445cb4", "553f64001e0e802a9619bd934d791155"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Overlord RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Overlord RAT IOCs detection rule, including tailored filters and exclusions to reduce noise in an enterprise environment:

Endpoint Management Tool Deployment (Microsoft Intune/SCCM)
- Scenario: During a scheduled software update or configuration push, Microsoft Endpoint Configuration Manager (SCCM) or Intune agents may execute scripts that generate network connections matching Overlord’s known IOCs. Specifically, the agent might establish outbound HTTPS connections to management servers using specific User-Agent strings or certificate thumbprints that overlap with Overlord’s signature.
- Filter/Exclusion: Exclude traffic originating from the C:\Program Files\Microsoft Intune Agent directory and filter out processes where the executable name contains IntuneManagementExtension.exe or ccmsetup.exe. Additionally, whitelist the specific destination IP ranges of your internal management servers if they match the rule’s network IOCs.
Automated Backup Solutions (Veeam/Commvault)
- Scenario: Enterprise backup agents like Veeam Backup & Replication often utilize remote control protocols to manage backup jobs. When a scheduled job initiates, the agent may spawn child processes that open specific ports or generate DNS queries identical to Overlord’s command-and-control (C2) patterns, particularly if the backup software uses a similar communication protocol structure.
- Filter/Exclusion: Create an exclusion rule for process paths containing Veeam\BackupAndReplication and exclude any detection where the parent process is vrb.exe. If the IOC involves specific registry keys related to remote control, exclude those keys if they are modified by the backup service account (e.g., DOMAIN\VeeamService).
IT Admin Remote Sessions via RDP/TeamViewer
- Scenario: System administrators frequently use remote access tools like TeamViewer or