ThreatFox: NetWire RC IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving known NetWire RC indicators of compromise to identify potential remote access trojan infections within the Azure environment. Proactively hunting for these specific IOCs is critical because early detection allows the SOC team to isolate compromised endpoints before attackers establish persistent command-and-control channels or exfiltrate sensitive data.

IOC Summary

Malware Family: NetWire RC Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`9ab6ffc449a0de80e5af4e690ef361ac01f500e8`	payload	2026-07-05	95%
md5_hash	`592c091f5b8dc2d2445618dac9938a66`	payload	2026-07-05	95%
md5_hash	`5e1208edaa128df0809ec8268be38ffc`	payload	2026-07-05	95%
sha256_hash	`87cf4ad614dbe8696401992fb8dde991f921adce680d91057e8fdb7c88e1a8c0`	payload	2026-07-05	95%
sha256_hash	`77f2de0a837eb3b6891f5984a542af71f559afb3d9e9e4e9d0b6cbf1f19a3dad`	payload	2026-07-05	95%
sha1_hash	`355109aca5726acd442299528c0e1bb112771525`	payload	2026-07-05	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NetWire RC
let malicious_hashes = dynamic(["9ab6ffc449a0de80e5af4e690ef361ac01f500e8", "592c091f5b8dc2d2445618dac9938a66", "5e1208edaa128df0809ec8268be38ffc", "87cf4ad614dbe8696401992fb8dde991f921adce680d91057e8fdb7c88e1a8c0", "77f2de0a837eb3b6891f5984a542af71f559afb3d9e9e4e9d0b6cbf1f19a3dad", "355109aca5726acd442299528c0e1bb112771525"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — NetWire RC

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: NetWire RC IOCs detection rule, tailored for an enterprise environment using common security and administrative tooling:

Endpoint Detection & Response (EDR) Scheduled Scans
- Scenario: The organization utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During off-hours maintenance windows, the EDR agent performs a deep heuristic scan of the C:\Program Files\NetWire RC directory. This activity generates network connections to known NetWire RC update servers and local file access patterns that match the rule’s IOCs (specifically hash matches and domain lookups).
- Filter/Exclusion: Create an exclusion for the EDR service account (e.g., NT AUTHORITY\SYSTEM or a specific svc_crowdstrike identity) when accessing NetWire RC paths. Alternatively, filter out traffic originating from the internal IP range of the EDR management console during scheduled maintenance windows (e.g., 02:00–04:00 UTC).
Group Policy Object (GPO) Software Deployment
- Scenario: The IT operations team deploys a patch or configuration update for NetWire RC via Microsoft SCCM (Configuration Manager) or Intune. The deployment process triggers the installation of new components, causing the client machines to query the internal software distribution point and external vendor repositories. This generates DNS queries and HTTP/HTTPS traffic that align with the NetWire RC IOCs defined in the hunt package.
- Filter/Exclusion: Exclude events where the Process Name is ccmexec.exe (SCCM) or IntuneManagementExtension.exe and the Parent Process is a scheduled task runner (TaskEng.exe). Additionally, whitelist traffic destined for the internal Software Distribution Point IP addresses.
**Automated Backup and