ThreatFox: NetSupportManager RAT IOCs

Hunt Hypothesis

The detection identifies potential NetSupportManager RAT activity through known IOCs, indicating an adversary may be establishing remote control over compromised systems. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats leveraging this RAT before significant data exfiltration or system compromise occurs.

IOC Summary

Malware Family: NetSupportManager RAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NetSupportManager RAT
let malicious_ips = dynamic(["189.34.188.6", "24.134.4.221"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["189.34.188.6", "24.134.4.221"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NetSupportManager RAT

False Positive Guidance

• Scenario: Legitimate NetSupportManager Remote Support Tool Usage
  Description: IT administrators use the legitimate NetSupportManager tool for remote desktop support.
  Filter/Exclusion: process.name != "NetSupportManager.exe" OR process.parent.name == "explorer.exe" OR "taskmgr.exe"

• Scenario: Scheduled Maintenance Job Using NetSupportManager
  Description: A scheduled task runs NetSupportManager to perform routine system checks or updates.
  Filter/Exclusion: process.name == "NetSupportManager.exe" AND event_id == "TaskScheduler" OR process.parent.name == "schtasks.exe"

• Scenario: Admin Task to Deploy Software via NetSupportManager
  Description: IT admins use NetSupportManager to push software updates to endpoints.
  Filter/Exclusion: process.name == "NetSupportManager.exe" AND user.name == "ITAdminUser" OR process.parent.name == "msiexec.exe"

• Scenario: Network Monitoring Tool Generating False Positives
  Description: A network monitoring tool (e.g., PRTG, SolarWinds) uses similar IOCs in its configuration files.
  Filter/Exclusion: file.path != "C:\Program Files\NetSupportManager\*" OR file.name != "NetSupportManager.exe"

• Scenario: Malware Analysis Lab Environment
  Description: A sandbox or malware analysis environment runs NetSupportManager as part of testing.
  Filter/Exclusion: process.name == "NetSupportManager.exe" AND host.name == "sandbox-vm-01" OR process.parent.name == "vmtoolsd.exe"