ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring for three specific Indicators of Compromise (IOCs) linked to an unknown threat actor. A proactive hunt is essential in Azure Sentinel to rapidly isolate these stealthy threats before they establish persistence or exfiltrate sensitive data, given the high severity and evolving nature of RAT-based attacks.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["124.198.131.91", "217.217.97.11", "45.83.31.84"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.198.131.91", "217.217.97.11", "45.83.31.84"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs rule, along with targeted filtering strategies:

• Scenario: Automated Endpoint Protection Scans by CrowdStrike Falcon

  • Context: The CrowdStrike Falcon sensor performs scheduled deep scans that generate temporary network connections to external update servers and telemetry endpoints. These connections often match the “Unknown” signature of a Remote Access Trojan (RAT) due to non-standard ports or dynamic IP ranges used for cloud telemetry.
  • Filter/Exclusion: Create an exclusion rule based on the ProcessName equal to FalconSensorService.exe and CommandLine containing /scan. Additionally, whitelist the specific outbound destination IPs associated with CrowdStrike’s global update infrastructure (e.g., *.falcon.crowdstrike.com).

• Scenario: Scheduled PowerShell Backup Jobs via Azure Arc

  • Context: Enterprise backup routines utilize scheduled tasks running powershell.exe to connect to Azure Storage accounts. These jobs often initiate outbound HTTPS connections with dynamic user-agent strings that do not match known RAT signatures, triggering the “Unknown” IOC logic when accessing external blob storage endpoints.
  • Filter/Exclusion: Exclude alerts where the parent process is TaskScheduler.exe and the command line contains specific backup keywords (e.g., -BackupJob, -AzureArc). Implement a filter to allow traffic from the known Azure Storage IP ranges defined in the enterprise’s network topology.

• Scenario: Third-Party Remote Support Tools (e.g., BeyondTrust or ConnectWise)

  • Context: IT Helpdesk teams utilize tools like BeyondTrust or ConnectWise ScreenConnect for remote troubleshooting. These agents establish persistent, encrypted tunnels to external relay servers that may not be in the ThreatFox known-good database, causing them to appear as unknown RAT activity during active support sessions.

  ---