ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hunt targets adversaries leveraging Ghost RAT to establish command-and-control persistence and exfiltrate sensitive data following initial compromise via phishing or malicious downloads. Proactively hunting for these specific IOCs in Azure Sentinel is critical because early detection of this high-severity remote access trojan can prevent long-term unauthorized system control before significant data loss occurs.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`8d9fa801432654ebfe456974bb355bd2`	payload	2026-07-18	95%
sha256_hash	`6aa982f7c6167752e8f58083dc5f1c11ff0aa63b3c3d2e192009cce2cef84ee0`	payload	2026-07-18	95%
sha1_hash	`875108112d2fdfbdb04d75bbbe993b1ce8aea140`	payload	2026-07-18	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["8d9fa801432654ebfe456974bb355bd2", "6aa982f7c6167752e8f58083dc5f1c11ff0aa63b3c3d2e192009cce2cef84ee0", "875108112d2fdfbdb04d75bbbe993b1ce8aea140"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Ghost RAT IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Legitimate Software Deployment via SCCM/Intune
- Scenario: Enterprise IT administrators deploy updated versions of remote management tools (e.g., Microsoft Endpoint Configuration Manager or Intune) that include Ghost RAT-compatible components for patching and inventory. The installation process triggers the detection logic because the installer creates new scheduled tasks, modifies registry keys under HKLM\Software, and establishes outbound connections to known update servers, mimicking the initial infection behavior of Ghost RAT arriving via a software download.
- Filter/Exclusion: Create an exclusion rule for processes originating from trusted application paths (e.g., C:\Program Files\Microsoft Configuration Manager) and whitelist specific SHA-256 hashes of the official installer executables known to be part of the approved deployment pipeline.
Scheduled Administrative Maintenance Jobs
- Scenario: A nightly scheduled task (Task Scheduler) runs a PowerShell script or a third-party backup utility (e.g., Veeam Agent or Commvault) that executes remote commands to verify system health and transfer logs to a central repository. These jobs often spawn child processes with elevated privileges, execute command-line arguments resembling RAT payloads, and open persistent network listeners on standard ports (80/443), triggering the “maintain persistent control” aspect of the rule.
- Filter/Exclusion: Exclude alerts where the parent process is TaskScheduler.exe or specific service accounts (e.g., DOMAIN\svc_backup_user) and limit detection to non-business hours if the activity aligns with known maintenance windows defined in the IT calendar.
IT Helpdesk Remote Support Sessions
- Scenario: During active helpdesk tickets, support engineers initiate remote sessions using enterprise-grade