ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the TonRAT remote access trojan by monitoring for specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactively hunting for these IOCs is critical to identify early-stage lateral movement and command-and-control communications that could lead to persistent data exfiltration or credential theft before full-scale exploitation occurs.

IOC Summary

Malware Family: TonRAT Total IOCs: 11 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["drivephoto-guest.info", "ejevanjc.info", "extranet-help-desk26.com", "file-load-20.info", "haksdkweqw219dms.com", "img-load2280.info", "load-file0228.info", "load-file2754.info", "reservationcheckid9567.info", "testload19.skin", "file-download.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: TonRAT IOCs detection rule in an enterprise environment:

• Scenario 1: Automated Endpoint Security Scans

  • Context: The organization’s endpoint protection suite (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) performs scheduled integrity checks that spawn processes matching the TonRAT hash signatures. These scans often execute during off-hours, triggering alerts when the IOCs are present in the security tool’s own binaries or update mechanisms.
  • Filter/Exclusion: Create a rule exclusion based on Process Name and Parent Process. Exclude alerts where the parent process is MsMpEng.exe (Microsoft Defender) or FalconSensor.exe (CrowdStrike), provided the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Microsoft Defender Antivirus).

• Scenario 2: Legacy Admin Maintenance Scripts

  • Context: Internal IT administrators utilize PowerShell scripts to manage user access and patch deployment. A specific legacy script, used for bulk account provisioning, invokes a helper utility that shares an identical SHA-256 hash with one of the TonRAT IOCs due to a shared open-source component (e.g., a specific version of a .NET runtime or logging library).
  • Filter/Exclusion: Implement a filter based on User Account and Command Line Arguments. Exclude alerts where the initiating user belongs to the IT_Operations group AND the command line contains the string --mode=maintenance. Additionally, whitelist the specific hash for this legacy script if it is verified as benign.

• Scenario 3: Third-Party Backup Agent Operations

  • Context: The enterprise utilizes a third-party backup solution (e.g., Veeam or Acronis) that runs scheduled