ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of an unknown Remote Access Trojan (RAT) by correlating eight specific Indicators of Compromise (IOCs) to identify early-stage lateral movement and command-and-control communications. Proactive hunting for these signatures in Azure Sentinel is critical because detecting this RAT before it establishes persistence allows the SOC team to mitigate potential data exfiltration and prevent long-term network compromise.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 8 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["45.13.238.92", "45.88.186.125"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.13.238.92", "45.88.186.125"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://irahook.com/babayla/zor/yarisirlar/", "https://irahook.com/?p=", "http://44.223.110.247:1337/get/config", "http://44.223.110.247:1337/mods/api/log-download", "http://44.223.110.247:1337/babayla/zor/yarisirlar/", "http://44.223.110.247:1337/?p="]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Unknown RAT IOCs detection rule in an enterprise environment:

• Endpoint Security Agent Updates & Telemetry

  • Scenario: The organization’s primary EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs a scheduled background update of its sensor binaries. These updates often involve downloading new definition files and establishing persistent network connections to vendor cloud endpoints that may not yet be whitelisted in the ThreatFox feed, triggering matches on the “Unknown RAT” IOCs (specifically regarding file hashes and network domains).
  • Filter/Exclusion: Create an exclusion rule based on the specific process names of the EDR agent (e.g., csagent.exe, MsMpEng.exe, SentinelOneService.exe) and restrict the detection to only trigger if the source IP is external to the known vendor update ranges.

• IT Administration via Remote Desktop Services

  • Scenario: System administrators utilize remote management tools (e.g., Ivanti, SCCM/MECM, or Microsoft Endpoint Configuration Manager) to deploy patches or run PowerShell scripts across a fleet of workstations. These tools often spawn temporary processes that download configuration manifests from internal file shares or external repositories, generating network traffic and file creation events that mimic the behavior patterns of Remote Access Trojans (RATs).
  • Filter/Exclusion: Exclude alerts originating from known administrative service accounts (e.g., DOMAIN\svc_patch_deploy, DOMAIN\Admin_Grp) and filter out traffic destined for internal IP subnets designated as “Management Infrastructure” or specific trusted CDNs used by the patch management vendor.

• Scheduled Backup and Data Synchronization Jobs

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault, or Acronis) execute