ThreatFox: STRRAT IOCs

Hunt Hypothesis

This detection targets adversary activity linked to the STRRAT threat actor by identifying specific Indicators of Compromise (IOCs) that signal potential initial access or lateral movement within the network. Proactively hunting for these IOCs in Azure Sentinel is critical due to their high severity, enabling the SOC team to rapidly identify and contain early-stage compromises before they escalate into broader data breaches.

IOC Summary

Malware Family: STRRAT Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - STRRAT
let malicious_ips = dynamic(["77.110.115.255"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["77.110.115.255"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - STRRAT
let malicious_domains = dynamic(["selkin.newddns.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — STRRAT

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: STRRAT IOCs detection rule:

• Scenario: Scheduled Antivirus or EDR Full Scan triggering network connections to known update servers.

  • Context: Enterprise endpoints running Microsoft Defender for Endpoint or CrowdStrike Falcon initiate periodic full scans that query external repositories, inadvertently matching STRRAT IOCs (e.g., specific IP ranges or domain hashes used by the vendor’s telemetry service).
  • Suggested Filter/Exclusion: Create a suppression rule excluding alerts where the Process Name matches MsMpEng.exe, FalconSensorService.exe, or CrowdStrike.exe and the destination port is restricted to standard update ports (e.g., 443, 80).

• Scenario: Automated Patch Management Jobs connecting to vendor infrastructure.

  • Context: Centralized patching tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons execute scheduled tasks that download manifests and patches from cloud repositories which may share IP addresses or certificate fingerprints with STRRAT indicators.
  • Suggested Filter/Exclusion: Exclude alerts originating from the User Account of the patch management service account (e.g., DOMAIN\SCCM_Service_Acc) where the Process Command Line contains keywords like “Update”, “Patch”, or “Deployment”.

• Scenario: Cloud Backup Agents performing incremental data synchronization.

  • Context: Enterprise backup solutions such as Veeam Backup & Replication or Rubrik agents run scheduled jobs to sync metadata and logs with the cloud management console, generating network traffic that aligns with STRRAT IOCs associated with secure storage gateways.
  • Suggested Filter/Exclusion: Implement a filter excluding events where the `Process Name