ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the deployment of an unknown Remote Access Trojan (RAT) through specific Indicators of Compromise (IOCs). Proactive hunting for these signals in Azure Sentinel is critical to rapidly isolate potential lateral movement and data exfiltration threats before they evolve into a persistent compromise.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["91.92.33.132"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.33.132"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://encalabrino.life/.ssa-auth-connect/scn/reff/ScreenConnect.ClientSetup.exe"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Enterprise Endpoint Management Agent Updates

  • Scenario: Scheduled updates or configuration pushes from major EDR/MDM platforms (e.g., CrowdStrike Falcon, Microsoft Intune, or Ivanti) often generate new executable hashes and network connections that mimic Remote Access Trojan behavior. These agents frequently download “unknown” binaries to patch their own telemetry modules, triggering the hunt for unknown RAT IOCs before the vendor updates their internal whitelist.
  • Filter/Exclusion: Exclude processes running under the specific service accounts of these management tools (e.g., svc_falcon, Microsoft.AccountsControl) and filter out network connections originating from known vendor IP ranges listed in the ThreatFox intelligence feed for “Trusted Vendors.”

• IT Administration Remote Support Sessions

  • Scenario: Help desk engineers or system administrators utilizing remote support tools (e.g., TeamViewer, AnyDesk, or Splashtop) to troubleshoot user workstations. When an admin initiates a session, the tool spawns temporary helper processes and establishes outbound connections to relay servers that may not yet be recognized by the ThreatFox IOC database as “known,” leading to a flag for unknown RAT activity during peak support hours (e.g., 9 AM – 5 PM).
  • Filter/Exclusion: Create an exclusion rule based on the source user context; if the initiating process is launched by a domain account within the IT-Admins or HelpDesk security groups, suppress the alert. Additionally, whitelist the specific executable paths of these approved remote support tools (e.g., C:\Program Files\TeamViewer\TeamViewer_Service.exe).

• **Automated Backup and Data Synchronization Jobs