ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the Ghost Remote Access Trojan by identifying specific indicators of compromise that signal unauthorized remote access and potential data exfiltration. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage infections before they escalate into persistent threats capable of lateral movement within the cloud environment.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`199af4936e44ed894ea45b84500a84268792dca3`	payload	2026-07-14	95%
md5_hash	`f1a04ffaa889c11b99b33610e4a87dec`	payload	2026-07-14	95%
sha256_hash	`4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4`	payload	2026-07-14	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Ghost RAT
let malicious_hashes = dynamic(["199af4936e44ed894ea45b84500a84268792dca3", "f1a04ffaa889c11b99b33610e4a87dec", "4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Ghost RAT IOCs detection rule, tailored for an enterprise environment:

Endpoint Protection Signature Updates via Microsoft Defender
- Scenario: The daily automated update cycle of Microsoft Defender Antivirus downloads and installs new definition packages. These updates often include generic heuristic signatures or network telemetry components that share hash values or file paths with the Ghost RAT IOCs, particularly when the vendor (ThreatFox) shares a common code signing certificate or utilizes similar DLL injection techniques for real-time scanning.
- Filter/Exclusion: Create an exclusion rule to ignore alerts originating from the C:\Program Files\Microsoft Defender directory and processes named MsMpEng.exe. Additionally, exclude network traffic where the destination IP belongs to Microsoft’s update content delivery network (e.g., *.update.microsoft.com).
Enterprise Software Deployment via SCCM or Intune
- Scenario: During a scheduled maintenance window, System Center Configuration Manager (SCCM) or Microsoft Intune pushes a new application package (e.g., Adobe Acrobat Reader or Zoom) to endpoints. The deployment agent (ccmexec.exe or IntuneManagementExtension) extracts installation binaries that contain embedded scripts or helper libraries matching the Ghost RAT IOCs, triggering the detection before the software is fully installed and whitelisted.
- Filter/Exclusion: Exclude process trees where the parent process is ccmexec.exe, Microsoft.IntuneManagementExtension.exe, or TaskScheduler (specifically tasks with names starting with “SoftwareUpdate_” or “AppDeployment_”).
Internal Security Scanning by CrowdStrike Falcon Sensor
- Scenario: The organization’s endpoint detection and response (EDR) solution, CrowdStrike Falcon, performs a scheduled deep-dive scan. The sensor injects its own monitoring agents into running processes to analyze memory integrity