ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the specific indicators of compromise (IOCs) linked to the TonRAT remote access trojan, which is known for establishing persistent footholds and exfiltrating sensitive data from compromised endpoints. SOC teams should proactively search for these IOCs within Azure Sentinel to identify early-stage infections before attackers can leverage TonRAT’s capabilities to escalate privileges or move laterally across the network.

IOC Summary

Malware Family: TonRAT Total IOCs: 8 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["extranethelp-desk2026.com", "image-guestsite.info", "image-id9438372.click", "img-load2026089.info", "load-img8388.click", "newphotoguest.info", "testload250808.mom"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - TonRAT
let malicious_urls = dynamic(["https://odxvj-fii5.marysasha20520.workers.dev/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: TonRAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Administration via PowerShell

  • Context: Enterprise System Administrators frequently use PowerShell.exe to query remote servers or execute configuration scripts. If the TonRAT IOC includes a specific hash or file path associated with a standard Microsoft management utility, legitimate admin sessions may trigger an alert when they download or execute this tool on a workstation.
  • Filter/Exclusion: Create a rule exclusion for PowerShell.exe processes where the parent process is System (for scheduled tasks) or WinRM, and the execution path matches the standard Windows directory (C:\Windows\System32\). Additionally, exclude alerts originating from known “Jump Box” or “Admin Workstation” computer groups.

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint Protection platforms like Microsoft Defender for Endpoint, CrowdStrike Falcon, or Symantec Endpoint Protection run scheduled jobs to download the latest definition updates. If one of the TonRAT IOCs corresponds to a common update server URL, IP address, or a specific updater executable hash used by these vendors, the nightly update cycle will generate false positives.
  • Filter/Exclusion: Exclude network traffic and process execution events where the destination IP belongs to known vendor update ranges (e.g., Microsoft Update CDN IPs) or where the process name matches MpCmdRun.exe (Defender), CnsNotify.exe (CrowdStrike), or Rtvscan64.exe (Symantec).

• Scenario: Internal Patch Management Deployment

  • Context: Organizations using tools like Microsoft Endpoint Configuration Manager (MECM/SCCM) or **Iv