ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies unknown Remote Access Trojan (RAT) indicators of compromise that may signal an adversary establishing covert command and control channels within the network. Proactive hunting for these IOCs in Azure Sentinel is critical to uncover stealthy lateral movement or data exfiltration attempts before they escalate into a full-scale breach.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["217.60.241.32", "147.189.169.192"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["217.60.241.32", "147.189.169.192"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Endpoint Scanning by Antivirus Engines

  • Context: Enterprise-grade EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background scans that generate network connections to update servers or cloud repositories. These connections often match generic Remote Access Tool (RAT) signatures due to similar port usage and payload structures, triggering alerts when the specific IOCs are not yet in the local threat intelligence feed.
  • Suggested Filter/Exclusion: Create a whitelist exclusion for known EDR process names (e.g., C:\Program Files\CrowdStrike\fsquint.exe, C:\Windows\System32\DwService.exe) and their associated update endpoints. Additionally, filter out traffic originating from the internal IP range of the Security Operations Center (SOC) management servers where these agents reside.

• Scenario: Scheduled Remote Management Sessions via RMM Tools

  • Context: IT operations teams utilize Remote Monitoring and Management (RMM) platforms such as ManageEngine Desktop Central, NinjaOne, or Kaseya VSA. These tools execute scheduled jobs (e.g., nightly patching, inventory collection) that initiate remote connections to endpoints. The detection logic may misinterpret these legitimate management sessions as unknown RAT activity because the RMM’s specific IOCs are not yet ingested into the ThreatFox database.
  • Suggested Filter/Exclusion: Implement a rule exclusion based on the source IP addresses of the central RMM servers and the destination ports commonly used by these tools (e.g., TCP 443, 8080). Furthermore, add a time-based filter to suppress alerts during known maintenance windows (