ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hunt targets indicators of compromise associated with an unidentified Remote Access Trojan, which adversaries deploy to establish persistent, covert control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected systems before the attacker leverages the RAT for lateral movement or data exfiltration.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["191.101.130.73"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["191.101.130.73"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["relay.miranarts-top.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Legitimate Remote Support Tooling: IT support teams often deploy commercial remote access agents (e.g., TeamViewer, AnyDesk, or LogMeIn) that may register specific mutexes, file paths, or network connections matching generic RAT IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is a known support agent executable (e.g., TeamViewer.exe, AnyDesk.exe) or exclude connections to known vendor IP ranges associated with these tools.
• Software Development and Debugging: Developers using Visual Studio, IntelliJ IDEA, or Eclipse may launch debuggers or attach to processes, creating temporary files or specific registry keys in C:\Users\<User>\AppData\Local\Temp or C:\ProgramData that mimic RAT staging areas.
  • Filter/Exclusion: Exclude file creation or registry modifications where the parent process is a known IDE executable (e.g., devenv.exe, idea64.exe) or where the file path contains standard development subdirectories like \bin\ or \obj\.
• Scheduled Maintenance and Backup Jobs: Enterprise backup solutions (e.g., Veeam, Commvault) or patch management tools (e.g., WSUS, SCCM) may create temporary staging files or modify system directories during scheduled maintenance windows, potentially triggering IOCs related to file writes in system paths.
  • Filter/Exclusion: Exclude events where the initiating process is a known backup or patching service executable (e.g., VeeamBackup.exe, Dism.exe) or where the event occurs during defined maintenance windows (e.g., 02:00–04:00 UTC) on server roles.
• Browser Extensions and Plugins: Web browsers like Chrome or Edge may load extensions or