← Back to SOC feed Coverage →

Detetcs the Nanocore RAT

yara CRITICAL Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-13T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Nanocore Remote Access Trojan to establish persistent command-and-control channels and execute remote actions on compromised endpoints within the Azure environment. The SOC team should proactively hunt for this specific RAT behavior in Azure Sentinel because its critical severity indicates a high risk of undetected lateral movement and data exfiltration that requires immediate validation beyond automated alerting.

YARA Rule

rule Nanocore_RAT_Gen_2 {
	meta:
		description = "Detetcs the Nanocore RAT"
		author = "Florian Roth"
		score = 100
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
	strings:
		$x1 = "NanoCore.ClientPluginHost" fullword ascii
		$x2 = "IClientNetworkHost" fullword ascii
		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Nanocore RAT detection rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/RAT_Nanocore.yar