ThreatFox: EtherRAT IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with EtherRAT, a remote access trojan frequently used for initial access and lateral movement. Proactively hunting for these IOCs allows the SOC team to identify compromised hosts early, preventing the adversary from establishing persistent control or exfiltrating sensitive data within the Azure environment.

IOC Summary

Malware Family: EtherRAT Total IOCs: 8 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - EtherRAT
let malicious_domains = dynamic(["time.austriaeast.cloudapp.azure.com", "timesync.westus2.cloudapp.azure.com", "zigbee.eastus.cloudapp.azure.com", "zigfree.eastus.cloudapp.azure.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - EtherRAT
let malicious_urls = dynamic(["https://time.austriaeast.cloudapp.azure.com", "https://timesync.westus2.cloudapp.azure.com", "https://zigbee.eastus.cloudapp.azure.com", "https://zigfree.eastus.cloudapp.azure.com"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — EtherRAT

False Positive Guidance

• Scenario: A DevOps engineer uses a custom PowerShell script to deploy a lightweight monitoring agent or a specific build tool that shares a hash or memory pattern with one of the EtherRAT IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is powershell.exe or pwsh.exe and the command line contains specific deployment keywords (e.g., -Install, -Deploy, or specific module names like Pester or DSC).
• Scenario: An IT administrator runs a standard Windows Update or patch management task using wuauclt.exe or usoclient.exe, which may temporarily load a driver or binary that matches a known EtherRAT file hash due to shared code libraries or similar compilation timestamps.
  • Filter/Exclusion: Exclude detections where the process name is wuauclt.exe, usoclient.exe, or trustedinstaller.exe, or where the file path resides in C:\Windows\SoftwareDistribution or C:\Windows\Installer.
• Scenario: A security team performs a scheduled vulnerability scan or memory dump analysis using tools like Sysinternals (e.g., procdump.exe) or commercial EDR agents, which may load a test binary or a known-good sample that matches an EtherRAT IOC.
  • Filter/Exclusion: Exclude processes where the parent is a known security tool (e.g., procdump.exe, sysmon.exe, edr_agent.exe) or where the file path contains \Sysinternals\ or \SecurityTools\.
• Scenario: A developer tests a new application build in a local environment where the executable is signed with a development certificate and has a hash that coincidentally matches one of the 8 IOCs, especially if the build is not yet fully optimized or stripped.

  ---