NetWiredRC

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging remote control mechanisms within the NetWiredRC framework to establish persistent command-and-control channels or execute lateral movement across the network. Proactive hunting for this behavior in Azure Sentinel is critical because early identification of these low-severity signals can reveal stealthy reconnaissance activities before they escalate into significant security incidents.

YARA Rule

rule NetWiredRC_B : RAT
{
	meta:
		description = "NetWiredRC"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2014-12-23"
		filetype = "memory"
		version = "1.1" 

	strings:
		$mutex = "LmddnIkX"

		$str1 = "%s.Identifier"
		$str2 = "%d:%I64u:%s%s;"
		$str3 = "%s%.2d-%.2d-%.4d"
		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d"
		
		$klg1 = "[Backspace]"
		$klg2 = "[Enter]"
		$klg3 = "[Tab]"
		$klg4 = "[Arrow Left]"
		$klg5 = "[Arrow Up]"
		$klg6 = "[Arrow Right]"
		$klg7 = "[Arrow Down]"
		$klg8 = "[Home]"
		$klg9 = "[Page Up]"
		$klg10 = "[Page Down]"
		$klg11 = "[End]"
		$klg12 = "[Break]"
		$klg13 = "[Delete]"
		$klg14 = "[Insert]"
		$klg15 = "[Print Screen]"
		$klg16 = "[Scroll Lock]"
		$klg17 = "[Caps Lock]"
		$klg18 = "[Alt]"
		$klg19 = "[Esc]"
		$klg20 = "[Ctrl+%c]"

	condition: 
		$mutex or (1 of ($str*) and 1 of ($klg*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 26 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the NetWiredRC detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Group Policy Updates via Microsoft SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) agent triggers a scheduled task to push new security policies or software updates to domain-joined workstations. This activity generates high-volume network traffic from the management server to client machines, mimicking unauthorized remote configuration changes often flagged by NetWiredRC.
  • Filter/Exclusion: Exclude traffic where the source IP belongs to the SCCM Management Point subnet and the destination port is 443 or 8530. Additionally, filter for process names containing ccmexec.exe with a known digital signature hash.

• Automated Patch Deployment using Ansible Tower

  • Scenario: The IT Operations team runs an overnight Ansible playbook to update kernel parameters and firewall rules across a fleet of Linux servers. The Ansible controller establishes SSH connections to multiple targets simultaneously, executing remote commands that look like suspicious administrative sessions.
  • Filter/Exclusion: Create an exclusion for source IPs assigned to the Ansible Controller cluster. Filter logs where the user agent or connection metadata contains ansible and the destination port is 22. Ensure the action matches known playbook execution tags (e.g., task_id: nightly-patch).

• Database Backup Jobs via Veeam Backup & Replication

  • Scenario: During peak backup windows, the Veeam server initiates remote copy jobs to replicate SQL database instances. This involves establishing persistent connections and transferring large data blocks, which can be misinterpreted as a new, unauthorized remote access session attempting to modify database configurations.
  • Filter/Exclusion: Exclude traffic originating from the Veeam Backup Server IP range