Detetcs the Nanocore RAT and similar malware

Hunt Hypothesis

This hunt targets adversaries deploying Nanocore Remote Access Trojans (RAT) to establish persistent command-and-control channels for data exfiltration and lateral movement within the network. Proactive hunting in Azure Sentinel is critical because these sophisticated malware families often evade signature-based detection, requiring behavioral analysis of suspicious process execution and network connections to identify early-stage compromises before they escalate into major incidents.

YARA Rule

rule Nanocore_RAT_Gen_1 {
	meta:
		description = "Detetcs the Nanocore RAT and similar malware"
		author = "Florian Roth"
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		score = 70
		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
	strings:
		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
		$x2 = "RunPE1" fullword ascii
		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
		$x5 = "Monitorinjection" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Nanocore RAT detection rule in an enterprise environment, along with suggested filters or exclusions:

• Enterprise Endpoint Management Deployments

  • Scenario: Automated deployment tools like Microsoft SCCM (ConfigMgr) or Ivanti Workspace Control push software updates and configuration scripts to endpoints. These agents often create new user-mode processes that inject code into existing shells (like explorer.exe or chrome.exe) to enforce policies, mimicking the hooking behavior of Nanocore RAT.
  • Filter/Exclusion: Exclude process paths containing known enterprise management directories (e.g., C:\Program Files\Microsoft Intune, C:\ProgramData\Ivanti). Additionally, filter by parent process names such as ccmexec.exe or WUAHandler.exe.

• Scheduled Backup and Antivirus Scans

  • Scenario: Scheduled jobs running via Windows Task Scheduler that trigger backup agents (e.g., Veeam Agent, Commvault) or on-demand antivirus scans. These tools frequently spawn helper processes to scan memory and file systems, creating legitimate process injection events that resemble RAT activity.
  • Filter/Exclusion: Create an exclusion for specific scheduled task names (e.g., *VeeamBackup*, *AntivirusOnDemandScan*). Filter by the parent process being svchost.exe with a service name matching known backup or security services, and restrict alerts to business hours if the job is known to run during workdays.

• Remote Desktop and Support Sessions

  • Scenario: Legitimate remote support sessions initiated by IT helpdesk staff using tools like Microsoft Remote Desktop (mstsc.exe), TeamViewer, or BeyondTrust. When an analyst connects, the host machine spawns a session manager