ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by flagging unknown Indicators of Compromise (IOCs) that may signal an adversary establishing persistent command and control channels within the environment. Proactively hunting for these signals in Azure Sentinel is critical to rapidly isolate compromised endpoints before attackers can escalate privileges or exfiltrate sensitive data through stealthy, unrecognized connections.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["94.154.32.205", "94.154.32.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.32.205", "94.154.32.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Endpoint Protection Scans by CrowdStrike Falcon or Microsoft Defender

  • Context: Security agents often perform deep file integrity checks or heuristic scans on executable files in the C:\Program Files directory. These scans may generate network connections to unknown endpoints (e.g., temporary update servers or cloud storage buckets) that mimic Remote Access Tool (RAT) behavior, triggering the rule when the specific IOCs are not yet in the ThreatFox whitelist.
  • Suggested Filter/Exclusion: Exclude traffic originating from service accounts running the security agent (e.g., CRFALCON_SERVICE or MsMpEng) where the destination port is restricted to standard update ports (443, 80) and the process path matches known agent installation directories.

• Scenario: Scheduled PowerShell Script Execution for Patch Management

  • Context: IT operations teams frequently utilize scheduled tasks (e.g., via Windows Task Scheduler or SCCM) running powershell.exe to download patches from internal repositories or third-party vendors like Ivanti or ManageEngine. These scripts often establish outbound connections to unknown IP addresses that are not yet cataloged in the ThreatFox database, appearing as suspicious RAT activity.
  • Suggested Filter/Exclusion: Create an exclusion for powershell.exe processes launched by the SYSTEM account with a command line argument containing specific tags (e.g., -ExecutionPolicy Bypass -File "C:\Scripts\PatchJob.ps1") and restrict this to business hours or specific maintenance windows.

• Scenario: Remote Desktop Services (RDS) Gateway Connections

  • Context: In hybrid environments, users connecting via Citrix Workspace or Microsoft