win exe njRAT

Hunt Hypothesis

This detection identifies the execution of njRAT malware on Windows endpoints by leveraging a specific YARA signature to catch known malicious binaries that may evade standard AV signatures. Proactively hunting for this behavior in Azure Sentinel is critical because njRAT’s remote access capabilities allow adversaries to establish persistent command-and-control channels, enabling early discovery before lateral movement or data exfiltration occurs.

YARA Rule

rule win_exe_njRAT 
{
meta:
author = "[email protected]"
descripion = "njRAT - Remote Access Trojan"
comment = "Variants have also been observed obfuscated with .NET Reactor"
filetype = "pe"
date = "2013-07-15"
version = "1.0"
hash1 = "92ee1fb5df21d8cfafa2b02b6a25bd3b"
hash2 = "3576d40ce18bb0349f9dfa42b8911c3a"
hash3 = "24cc5b811a7f9591e7f2cb9a818be104"
hash4 = "3ad5fded9d7fdf1c2f6102f4874b2d52"
hash5 = "a98b4c99f64315aac9dd992593830f35"
hash6 ="5fcb5282da1a2a0f053051c8da1686ef"
hash7 = "a669c0da6309a930af16381b18ba2f9d"
hash8 = "79dce17498e1997264346b162b09bde8"
hash9 = "fc96a7e27b1d3dab715b2732d5c86f80"
ref1 = "http://bit.ly/19tlf4s"
ref2 = "http://www.fidelissecurity.com/threatadvisory"
ref3 = "http://www.threatgeek.com/2013/06/fidelis-threat-advisory-1009-njratuncovered.html"
ref4 = "http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered.pdf"

strings:
$magic = "MZ"
$string_setA_1 = "FromBase64String"
$string_setA_2 = "Base64String"
$string_setA_3 = "Connected" wide ascii
$string_setA_4 = "Receive"
$string_setA_5 = "DeleteSubKey" wide ascii
$string_setA_6 = "get_MachineName"
$string_setA_7 = "get_UserName"
$string_setA_8 = "get_LastWriteTime"
$string_setA_9 = "GetVolumeInformation"

$string_setB_1 = "OSFullName" wide ascii
$string_setB_2 = "Send" wide ascii
$string_setB_3 = "Connected" wide ascii
$string_setB_4 = "DownloadData" wide ascii
$string_setB_5 = "netsh firewall" wide
$string_setB_6 = "cmd.exe /k ping 0 & del" wide

condition:
($magic at 0) and ( all of ($string_setA*) or all of ($string_setB*) ) 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the win exe njRAT detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Deployment of Endpoint Protection Agents via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes updates to the njRAT agent component. The deployment process involves extracting a compressed archive containing njrat.exe and launching it with specific command-line arguments for silent installation. Because the executable is dropped into a temporary folder before being moved to its final location, the YARA rule may flag the initial execution as suspicious.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the file path contains \Temp\ or \SoftwareDistribution\. Additionally, filter by command-line arguments containing /silent, /install, or MSIEXEC.

• Scenario: Execution of Third-Party Remote Support Tools

  • Context: IT Help Desk analysts frequently utilize remote support tools like TeamViewer, AnyDesk, or Splashtop. These applications often include a background service named njrat (or similar naming conventions) to manage the connection handshake and screen sharing sessions. When an analyst initiates a session, the tool launches this executable with elevated privileges, triggering the NJRAT signature due to its network binding behavior.
  • Suggested Filter/Exclusion: Create an exclusion for file paths located in C:\Program Files\TeamViewer\, C:\ProgramData\AnyDesk\, or specific vendor directories (e.g., \Splashtop\). Ensure the filter checks that the executable hash matches a known, whitelisted version of these support tools.

• **Scenario: Automated