ThreatFox: TonRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known TonRAT indicators of compromise to identify potential remote access trojan infections within the environment. Proactively hunting for these specific IOCs in Azure Sentinel is critical because TonRAT enables attackers to establish persistent command and control channels that can lead to data exfiltration or lateral movement if left undetected.

IOC Summary

Malware Family: TonRAT Total IOCs: 2 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - TonRAT
let malicious_domains = dynamic(["photo-drivehotel.com", "photo-id83247.info"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — TonRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: TonRAT IOCs detection rule in an enterprise environment:

• Scenario: Legitimate EDR Agent Communication with Cloud Management Console

  • Context: The enterprise uses CrowdStrike Falcon or Microsoft Defender for Endpoint. The security agents periodically poll the central management cloud to fetch policy updates and upload telemetry, which may match TonRAT’s C2 IP addresses or domain hashes.
  • Filter/Exclusion: Create an exclusion rule that suppresses alerts where the source process is FalconSensor.exe (CrowdStrike) or MsMpEng.exe / SenseService.exe (Microsoft Defender) communicating with known internal management subnets or specific cloud endpoints (e.g., *.falcon.crowdstrike.com).

• Scenario: Scheduled Software Deployment via SCCM/Intune

  • Context: The IT Operations team runs nightly scheduled tasks using Microsoft Endpoint Configuration Manager (SCCM) or Intune to deploy patches. These deployment agents often establish outbound connections to software update repositories that share network signatures with TonRAT IOCs, particularly during the initial handshake phase of large payload downloads.
  • Filter/Exclusion: Exclude alerts where the parent process is ccmsetup.exe or AppxDeploymentAgent.exe and the connection destination matches the specific IP ranges used by the organization’s Software Update Point (SUP) servers.

• Scenario: Automated Backup Jobs to Cloud Storage

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik perform scheduled backups to cloud storage providers (e.g., AWS S3, Azure Blob). The backup agents initiate connections that may utilize ports and protocols identical to those flagged by the TonRAT rule.
  • **Filter/Exclusion