Njrat

Hunt Hypothesis

This detection rule identifies potential NjRAT remote access trojan activity by monitoring for its characteristic command-and-control communications and file execution patterns within Azure Sentinel. Proactively hunting for this behavior is critical because NjRAT’s low-severity footprint often allows it to establish persistence undetected, enabling adversaries to conduct long-term reconnaissance before escalating to data exfiltration or lateral movement.

YARA Rule

rule Njrat: RAT
{
    meta:
        description = "Njrat"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /(F)romBase64String/
        $string2 = /(B)ase64String/
        $string3 = /(C)onnected/ wide ascii
        $string4 = /(R)eceive/
        $string5 = /(S)end/ wide ascii
        $string6 = /(D)ownloadData/ wide ascii
        $string7 = /(D)eleteSubKey/ wide ascii
        $string8 = /(g)et_MachineName/
        $string9 = /(g)et_UserName/
        $string10 = /(g)et_LastWriteTime/
        $string11 = /(G)etVolumeInformation/
        $string12 = /(O)SFullName/ wide ascii
        $string13 = /(n)etsh firewall/ wide
        $string14 = /(c)md\.exe \/k ping 0 & del/ wide
        $string15 = /(c)md\.exe \/c ping 127\.0\.0\.1 & del/ wide
        $string16 = /(c)md\.exe \/c ping 0 -n 2 & del/ wide
        $string17 = {7C 00 27 00 7C 00 27 00 7C}

    condition:
        10 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 17 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Njrat detection rule in an enterprise environment, along with suggested filters and exclusions:

• Antivirus Real-Time Scanning of Malware Definitions

  • Scenario: Enterprise Endpoint Protection suites (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) frequently spawn helper processes to download and verify new malware definition updates. These processes often utilize network connections with high entropy payloads that mimic the command-and-control (C2) traffic patterns of Njrat, specifically when communicating with vendor update servers over HTTPS on non-standard ports.
  • Suggested Filter: Create an exclusion for known AV service executables (e.g., C:\Program Files\CrowdStrike\fs.exe, C:\Windows\System32\MsMpEng.exe) connecting to the specific IP ranges or FQDNs of the vendor’s update infrastructure.

• IT Asset Management and Patch Deployment Agents

  • Scenario: Automated patch management tools like Ivanti, SCCM (Microsoft Endpoint Configuration Manager), or Jamf Pro run scheduled jobs during maintenance windows to inventory hardware, check software versions, and push updates. These agents often establish persistent connections back to the central management server, generating traffic signatures that overlap with Njrat’s beaconing behavior, particularly when performing large data transfers of system logs.
  • Suggested Filter: Exclude traffic originating from the specific service accounts used by these tools (e.g., NT AUTHORITY\SCCM Agent Service) and whitelist the destination IP addresses of the central management console servers.

• Scheduled PowerShell Script Execution for Compliance Reporting

  • Scenario: Security teams often deploy scheduled Task Scheduler jobs running complex PowerShell scripts (powershell.exe or pwsh.exe) to gather compliance data, audit user permissions, and