ThreatFox: NjRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known NjRAT malware indicators to identify potential remote access and command-and-control activities within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical because NjRAT’s high severity classification suggests a significant risk of lateral movement and data exfiltration that may evade standard signature-based defenses without dedicated investigation.

IOC Summary

Malware Family: NjRAT Total IOCs: 4 IOC Types: md5_hash, sha256_hash, sha1_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NjRAT
let malicious_ips = dynamic(["178.80.40.237"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.80.40.237"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - NjRAT
let malicious_hashes = dynamic(["8043b87976309cfaf0ccff63f629b9b6", "475774774c013c3a5d6db3ccdb025504c7151999a63097bf98476578d0533f5b", "116e43d5451e060b48a892e46a6f83e0374bde3f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — NjRAT

False Positive Guidance

Here are four specific false positive scenarios for the ThreatFox: NjRAT IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Enterprise Endpoint Management Agent Updates

  • Context: The organization utilizes Microsoft Configuration Manager (SCCM) or Ivanti Endpoint Manager. During scheduled maintenance windows, these agents download and execute update packages that share file hashes or network signatures with NjRAT’s legitimate components. Specifically, the njrat.exe process name is often used by internal patching scripts to manage remote sessions.
  • Filter/Exclusion: Create an exclusion rule for processes originating from the C:\Program Files\Microsoft Configuration Manager or C:\Ivanti directories where the parent process is ccmexec.exe (SCCM) or agent.exe (Ivanti). Additionally, whitelist file hashes associated with known internal update manifests.

• Scenario: Scheduled Remote Desktop Administration Tasks

  • Context: System administrators frequently deploy a custom PowerShell script named RemoteSessionManager.ps1 via the Windows Task Scheduler. This script initiates remote desktop connections to manage server health and uses a helper binary that mimics NjRAT’s network beaconing behavior (checking in with a central management server) to report status.
  • Filter/Exclusion: Exclude alerts where the command line arguments contain specific internal tags, such as --task-id:AdminHealthCheck or --source:InternalScheduler. Furthermore, filter out traffic originating from the “Domain Admins” security group when the destination IP is within the corporate management subnet (e.g., 10.20.x.x).

• Scenario: Third-Party Remote Support Tools

  • Context: The IT Helpdesk relies on BeyondTrust (formerly Bomgar) or **TeamViewer