This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the IceRat remote access tool, which is frequently utilized by threat actors for command and control operations. A SOC team should proactively search for these IOCs in Azure Sentinel to identify early-stage infections or lateral movement attempts that may have evaded standard signature-based detections.
Malware Family: IceRat Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 35daec4729842b66099ddbbe4bd1bc21240628d38f0e54a84b80d1fd11d2f1af | payload | 2026-08-25 | 95% |
| sha1_hash | 83e1cffed0bad229afac9c8fa285173d6f07dbc1 | payload | 2026-08-25 | 95% |
| md5_hash | d4a19a109b091d66e0930bd553256b1b | payload | 2026-08-25 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - IceRat
let malicious_hashes = dynamic(["35daec4729842b66099ddbbe4bd1bc21240628d38f0e54a84b80d1fd11d2f1af", "83e1cffed0bad229afac9c8fa285173d6f07dbc1", "d4a19a109b091d66e0930bd553256b1b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: The enterprise’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs an automated daily definition update that downloads and executes the IceRat detection signatures package, triggering a match on the specific hash IOCs defined in the rule.
Process Name of the endpoint agent (e.g., FalconSensor.exe or MsMpEng.exe) and restrict the alert to only trigger when the process is running under a non-admin service account context, excluding the system update service accounts.Scenario: A scheduled PowerShell job runs nightly to inventory software assets across the domain; this script executes a remote query against the IceRat IOC repository API to validate current threat intelligence feeds before generating a compliance report.
Parent Process is identified as PowerShell.exe (or pwsh.exe) and the Command Line contains specific keywords related to the inventory script name (e.g., -ExecutionPolicy Bypass -File "C:\Scripts\AssetInventory.ps1").Scenario: The IT Security team manually deploys a new security policy via Group Policy Objects (GPO) that includes a script to push IceRat IOC updates to all workstations, causing the detection engine to flag the deployment traffic as a potential threat match.
Source IP of the designated GPO controller server (e.g., 10.20.30.5) and limit the scope to events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: The organization’s internal DevOps pipeline utilizes a containerized build agent that pulls IceRat IOC