ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies unknown Remote Access Trojan (RAT) indicators of compromise that may signal an adversary establishing covert command and control channels within the environment. Proactively hunting for these signals in Azure Sentinel is critical to rapidly uncover stealthy RAT deployments before they escalate into broader data exfiltration or lateral movement incidents.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 6 IOC Types: domain, url

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["kolpa.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://kolpa.lol/mods/api/log-download", "https://kolpa.lol/ws", "https://kolpa.lol/?p=", "https://kolpa.lol/get/config", "https://kolpa.lol/babayla/zor/yarisirlar"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Management Tools (e.g., SCCM or Intune)

  • Context: Enterprise Configuration Management tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune often deploy remote agents that establish persistent connections to management servers. These agents may generate network traffic patterns (specific ports and user-agent strings) that mimic known Remote Access Trojan (RAT) behavior, triggering the rule when a new agent version is deployed without an updated IOC baseline.
  • Suggested Filter/Exclusion: Create an exclusion based on the Source Host Group or Process Name. Exclude traffic originating from hosts tagged with OS-Endpoint-Mgmt where the process name matches ccmexec.exe, intunacache.exe, or msdtc.exe. Additionally, whitelist specific destination IP ranges belonging to your internal Configuration Management infrastructure.

• Scenario: Scheduled Backup and Data Replication Jobs

  • Context: Automated backup solutions such as Veeam Backup & Replication or Rubrik often run scheduled jobs during off-hours that initiate high-volume data transfers over non-standard ports. If the detection logic flags unknown destination IPs or specific protocol handshakes associated with these replication streams, it may incorrectly classify them as RAT beaconing activity.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for known backup windows (e.g., 02:00–06:00 UTC). Furthermore, add an exclusion rule that ignores alerts where the Source Process is vrb.exe (Veeam) or rubrik-agent, and the destination port falls within the standard backup range (e.g., ports 9443, 1587, or