ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with TonRAT, a remote access trojan frequently used for initial access and persistence. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or cloud resources before the adversary can establish a foothold and execute further malicious activities.

IOC Summary

Malware Family: TonRAT Total IOCs: 3 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["hakdskajds398ska.com", "image-id64564234.click", "stay-room7245971.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

• Scenario: A DevOps engineer uses a custom Python script to perform automated health checks on a staging environment, which includes a ping or curl request to a known TonRAT C2 IP address (e.g., 192.168.1.50) that was previously used as a test endpoint and is now listed in the IOC package.
  • Filter/Exclusion: Exclude alerts where the source process is python.exe or python3.exe and the destination port is 80 or 443, provided the source host is tagged with Environment: Staging or Role: DevOps.
• Scenario: An IT administrator runs a batch script (cleanup.bat) on a domain controller to archive old logs to a shared network drive. The script uses robocopy to transfer files to a server whose IP address matches one of the TonRAT IOCs (e.g., 10.0.2.15) due to a recent IP reassignment in the internal network that hasn’t been updated in the threat feed.
  • Filter/Exclusion: Exclude alerts where the source process is cmd.exe or powershell.exe executing a script from a standard admin path (e.g., C:\Admin\Scripts\ or C:\Temp\) and the destination is an internal RFC1918 address, unless the source host is in the Production environment.
• Scenario: A security team performs a purple team exercise using a tool like Cobalt Strike or Metasploit to simulate a TonRAT infection. The beaconing IP or domain (e.g., tonrat-c2.example.com) is intentionally resolved to an internal jump server IP that matches an IOC.
  • Filter/Exclusion: Exclude alerts where the source host