This hunt targets adversary behavior involving NjRAT malware by identifying network connections and process executions matching three specific Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical to detect early-stage remote access tool deployments that could establish persistent command-and-control channels within the enterprise environment.
Malware Family: NjRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | 2e70ac7f1bdfc2f9912448ee2b6c2c478bef3aab | payload | 2026-07-10 | 95% |
| md5_hash | 1b622c451fcc9d83aad8bf45b1c42b5f | payload | 2026-07-10 | 95% |
| sha256_hash | df4e36252bf8a2b1dee291bcaf9e0505246cacc1d1ea9db3494f30c8506ba0cb | payload | 2026-07-10 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["2e70ac7f1bdfc2f9912448ee2b6c2c478bef3aab", "1b622c451fcc9d83aad8bf45b1c42b5f", "df4e36252bf8a2b1dee291bcaf9e0505246cacc1d1ea9db3494f30c8506ba0cb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Endpoint Security Agent Communication: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically queries the ThreatFox API to retrieve updated threat intelligence feeds. This legitimate outbound HTTP/HTTPS traffic from the security management server to api.threatfox.io matches the network IOC, while the subsequent file hash of the downloaded feed update matches a known NjRAT signature used in the feed itself.
*.threatfox.io and *.threatfox.com. Additionally, exclude file hash detections on the “Security Updates” volume path where the parent process is the EDR service (e.g., csfalcon.exe or MsMpEng.exe).Third-Party Patch Management Execution: During scheduled maintenance windows, a patch management tool like Ivanti or SCCM (System Center Configuration Manager) downloads and installs security updates. The installation package includes a dependency library that shares the same file hash as one of the NjRAT IOCs. This triggers an alert when the ccmexec.exe process writes this legitimate component to the %ProgramData% directory.
ccmexec.exe or IvantiAgentService.exe, specifically targeting files written to standard patch directories (e.g., C:\Windows\CCMCache\).Automated Threat Intelligence Ingestion Script: A scheduled PowerShell job (Task Scheduler) runs nightly to ingest external threat feeds into the SIEM. This script utilizes a Python wrapper that downloads the NjR