ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt targets adversary activity involving the three specific indicators of compromise linked to the NjRAT remote access trojan, which is frequently used to establish persistent command and control channels within compromised networks. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection of this high-severity threat enables the SOC team to rapidly isolate affected assets before attackers can exfiltrate sensitive data or pivot laterally across the environment.

IOC Summary

Malware Family: NjRAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NjRAT
let malicious_ips = dynamic(["158.160.75.185", "188.48.208.56", "209.99.185.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.160.75.185", "188.48.208.56", "209.99.185.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule in an enterprise environment, including targeted filters and exclusions:

• Software Deployment via SCCM/Intune: The deployment of a new remote management agent or patching utility (e.g., Microsoft Endpoint Configuration Manager or Jamf) often triggers the njrat.exe process or associated network connections. These legitimate tools frequently use similar communication patterns to NjRAT for status reporting and command execution.

  • Suggested Filter: Exclude processes originating from the specific software vendor’s signed certificate path (e.g., Microsoft Corporation) located in standard installation directories (C:\Program Files\Microsoft Configuration Manager\). Additionally, filter out network traffic destined for known internal management server IP ranges rather than external unknown IPs.

• Scheduled Administrative Maintenance Jobs: Enterprise administrators often utilize PowerShell scripts or batch files scheduled via Windows Task Scheduler to perform routine health checks on remote servers. If these scripts invoke a legitimate version of the NjRAT client (or a tool sharing its IOCs) for inventory collection, the rule will trigger during the execution window (e.g., every Sunday at 02:00 AM).

  • Suggested Filter: Create an exclusion based on the Parent Process Name being TaskScheduler.exe or svchost.exe, combined with a time-based filter to suppress alerts outside of defined maintenance windows. Verify that the process hash matches the known good baseline for the internal administration tool.

• Third-Party Remote Support Sessions: IT Helpdesk teams frequently use remote support tools (such as TeamViewer, AnyDesk, or LogMeIn) which may bundle NjRAT components or utilize similar IOCs for session establishment and file transfer. When a technician initiates an unscheduled support session on a user workstation, the detection logic may flag the