ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies unknown Remote Access Trojan (RAT) indicators that may signal an adversary establishing covert command and control channels within the network. Proactively hunting for these specific IOCs in Azure Sentinel is critical to uncover stealthy RAT deployments before they can exfiltrate sensitive data or facilitate lateral movement across the environment.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["91.193.7.186"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.193.7.186"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["out-agent.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, along with recommended filters and exclusions:

• Scenario 1: Automated Security Scanning by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background telemetry collection, hash verification, and policy updates. These processes often generate network connections to unknown external endpoints that mimic Remote Access Trojan (RAT) behavior but are part of standard agent maintenance.
  • Filter/Exclusion: Create a filter excluding traffic originating from the specific EDR service accounts (e.g., SYSTEM, LocalService) or whitelisting known EDR vendor IP ranges and process paths (e.g., C:\Program Files\CrowdStrike\fsquint.exe).

• Scenario 2: Scheduled Cloud Backup and Synchronization Jobs

  • Context: Automated backup solutions such as Veeam, Rubrik, or cloud sync tools like OneDrive for Business and Box Sync often initiate outbound connections to storage gateways. These jobs run on a schedule (e.g., nightly at 02:00) and may connect to new or rotating IP addresses that the ThreatFox feed has not yet classified as “known,” triggering an Unknown RAT alert due to high-volume data transfer patterns.
  • Filter/Exclusion: Implement a time-based exclusion for these specific processes during their scheduled maintenance windows (e.g., 01:00–04:00 UTC) or add the backup service executable paths (e.g., C:\Program Files\Veeam\Backup and Replication\Engine\vbengine.exe) to the allowlist.

• Scenario 3: IT Admin Remote Management Sessions