ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where Ghost RAT malware establishes persistence and exfiltrates data using specific known indicators of compromise within Azure Sentinel. Proactively hunting for these signatures is critical to identify early-stage infections before they escalate into full-scale lateral movement or data breaches across the cloud environment.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`974e94efa9515e53d57b16f538c37bb9a81a39ee`	payload	2026-07-16	95%
md5_hash	`3166ae39b46472d2ee53a880eb8248e0`	payload	2026-07-16	95%
sha256_hash	`0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["974e94efa9515e53d57b16f538c37bb9a81a39ee", "3166ae39b46472d2ee53a880eb8248e0", "0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Ghost RAT IOCs detection rule, tailored for an enterprise environment:

Endpoint Security Agent Signature Updates
- Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled signature update. During this process, the agent downloads and extracts a compressed package containing multiple security definitions that happen to share hash values or file paths with known Ghost RAT IOCs within the vendor’s own repository.
- Suggested Filter: Exclude network traffic and file creation events originating from the specific service accounts used by the EDR (e.g., svc-crowdstrike, Microsoft Defender Antivirus) during the defined maintenance window (e.g., 02:00–04:00 UTC).
IT Asset Management Inventory Scans
- Scenario: A scheduled inventory job using tools like Lansweeper or SCCM (System Center Configuration Manager) runs a deep scan across workstations. The scanner agent downloads a diagnostic utility package to verify hardware compatibility, which includes a set of telemetry scripts and configuration files that match the Ghost RAT IOC signatures used for asset tracking.
- Suggested Filter: Create an exclusion rule for processes spawned by the inventory management service (e.g., LansweeperAgent.exe, ccmexec.exe) specifically when they access directories designated as “Software Distribution” or “Inventory Staging” folders.
Developer Build and Deployment Pipelines
- Scenario: A CI/CD pipeline (using Jenkins, GitLab CI, or Azure DevOps) executes a build job on a shared build server. The pipeline downloads a third-party SDK or dependency library that contains embedded runtime components identical to the Ghost RAT IOCs detected in the hunt package, often triggered by automated nightly builds.
- **Suggested