ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior where Ghost RAT establishes persistence and executes remote commands to silently exfiltrate sensitive data from endpoints. Proactively hunting for these specific IOCs in Azure Sentinel is critical to detect early-stage infections before attackers can fully compromise the environment or expand their lateral movement capabilities.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`974e94efa9515e53d57b16f538c37bb9a81a39ee`	payload	2026-07-16	95%
md5_hash	`3166ae39b46472d2ee53a880eb8248e0`	payload	2026-07-16	95%
sha256_hash	`0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d`	payload	2026-07-16	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["974e94efa9515e53d57b16f538c37bb9a81a39ee", "3166ae39b46472d2ee53a880eb8248e0", "0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Ghost RAT IOCs detection rule, tailored for an enterprise environment:

Enterprise Endpoint Management Scans
- Scenario: The organization’s central management console (e.g., Microsoft Intune, Jamf Pro, or Ivanti) performs scheduled health checks and policy updates. During these windows, the agent process (intune-management-agent.exe or jamf-prod) initiates outbound connections to known vendor IP ranges that may overlap with Ghost RAT’s command-and-control (C2) infrastructure, specifically matching the “persistent connection” logic of the rule.
- Filter/Exclusion: Create a whitelist exclusion for the specific executable hashes and parent processes associated with the EMM agent. Additionally, exclude traffic destined to the verified vendor IP ranges listed in your Threat Intelligence feed (e.g., Microsoft’s public C2 IPs).
Automated Software Deployment via SCCM
- Scenario: A nightly scheduled task managed by Microsoft System Center Configuration Manager (SCCM) or Ansible Tower pushes software updates to the endpoint. The deployment agent (ccmexec.exe or ansible-runner) establishes a long-lived HTTPS connection to the distribution point server to download payloads and report status, mimicking the data exfiltration behavior flagged by the Ghost RAT rule.
- Filter/Exclusion: Exclude traffic originating from the SCCM client service where the destination port is 443 (HTTPS) and the User-Agent header contains “Microsoft-SoftwareUpdate” or specific Ansible identifiers. Ensure the source IP of the distribution point is added to the exclusion list.
Third-Party Backup and Synchronization Agents
- Scenario: Enterprise backup solutions like Veeam Agent, Carbonite, or OneDrive for Business run background synchronization jobs during