ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by correlating nine specific Indicators of Compromise (IOCs) that may signal an unknown adversary presence within the network. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify and contain stealthy RAT infections before they establish persistence or exfiltrate sensitive data.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 9 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["189.12.226.123", "192.30.241.253"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["189.12.226.123", "192.30.241.253"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["maguire.top", "botdev.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://botdev.lol/mods/api/log-download", "https://botdev.lol/ws", "https://botdev.lol/?p=", "https://botdev.lol/get/config", "https://botdev.lol/babayla/zor/yarisirlar/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, along with targeted filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The security team pushes a new policy update containing updated hash signatures or configuration changes. This triggers the MsMpEng.exe (Microsoft Antimalware Service Executable) to spawn child processes that match the generic RAT IOCs in the hunt package, specifically regarding network connectivity and registry modifications.
  • Filter/Exclusion: Exclude process paths where ProcessName equals MsMpEng.exe AND CommandLine contains “Update” or “Policy”. Additionally, filter out events occurring within 15 minutes of a scheduled GPO refresh window (e.g., 02:00–04:00 UTC).

• Automated Software Deployment via SCCM/Intune

  • Scenario: A scheduled task or Intune agent (ccmexec.exe or Microsoft.IntuneManagementAgent) deploys a new application (e.g., Zoom, Teams) to the endpoint. The installation process creates temporary network connections and registry keys that mimic the behavior of a Remote Access Trojan, triggering the 9 IOCs related to file creation and outbound traffic.
  • Filter/Exclusion: Create an exclusion for events where ParentProcessName is ccmexec.exe, Microsoft.IntuneManagementAgent.exe, or msiexec.exe. Filter based on a specific “Deployment ID” tag present in the event metadata if available, or exclude during known maintenance windows (e.g., Tuesday 01:00–03:00).

• Legacy Remote Support Tools (TeamViewer/AnyDesk) Usage

  • Scenario: Helpdesk analysts utilize legacy support tools like TeamViewer (`TeamViewer.exe