ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging phishing campaigns to deploy TonRAT, a remote access Trojan that establishes persistence while exfiltrating sensitive data and executing commands on compromised endpoints. Proactive hunting for these specific IOCs within Azure Sentinel is critical to identify early-stage infections before attackers can fully establish command-and-control channels or escalate their foothold in the environment.

IOC Summary

Malware Family: TonRAT Total IOCs: 8 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["secure-loadfile28.info", "vault-image.info", "docstore-s6.info", "exp-partner-statement.com", "photo-hub.info", "photonet-drive.com", "pic-vault.info", "secur3vault.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: TonRAT IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Legitimate Phishing Simulation Campaigns: Security teams often run internal phishing simulations using tools like KnowBe4 or Proofpoint, which distribute emails containing malicious-looking attachments (e.g., .docx with macros) to test user awareness. These emails may trigger the TonRAT detection logic if the simulation payload mimics the specific file hashes or network signatures of the actual Trojan.

  • Suggested Filter: Exclude traffic originating from internal IP ranges dedicated to security training platforms (e.g., 10.20.50.x) and filter out events where the sender domain matches known simulation domains (e.g., @security-training.internal).

• Automated Backup and Reporting Jobs: Scheduled tasks running via Microsoft Task Scheduler or Ansible Tower often generate reports or backup archives that are emailed to distribution lists. If these jobs utilize a specific email client or script that attaches documents with macros, they can mimic the “phishing arrival” vector of TonRAT.

  • Suggested Exclusion: Create an exclusion rule for processes running under the context of service accounts (e.g., DOMAIN\svc-backup) and exclude events where the parent process is identified as a known automation tool like Task Scheduler (SchTasks.exe) or specific backup agents like Veeam or Rubrik.

• Third-Party Document Collaboration: Enterprise users frequently utilize collaboration tools such as Microsoft SharePoint, Confluence, or Google Drive to share documents. When these platforms generate notification emails with embedded links or attachments, the file signatures may overlap with TonRAT IOCs, particularly if the organization uses a shared gateway for document processing.

  • Suggested Filter: Implement