ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring network traffic and endpoint logs against a curated set of ten unknown Indicators of Compromise (IOCs). Proactive hunting for these IOCs in Azure Sentinel is critical because RATs often establish persistent, low-profile footholds that evade standard signature-based defenses, necessitating early discovery to prevent lateral movement and data exfiltration.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 10 IOC Types: url, domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["192.159.99.227", "27.124.17.151"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["192.159.99.227", "27.124.17.151"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["moodess.ddns.net", "eureka.tf7757.org", "manita.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://manita.lol/mods/api/log-download", "https://manita.lol/ws", "https://manita.lol/get/config", "https://manita.lol/?p=", "https://manita.lol/babayla/zor/yarisirlar/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs rule, along with targeted filtering strategies suitable for an enterprise environment:

• Scenario: Enterprise Endpoint Protection Scanning

  • Context: The organization’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a scheduled “Deep Scan” of the C:\Program Files directory. During this process, the scanner generates temporary network connections to its cloud management server and downloads definition updates that match generic RAT signatures due to similar protocol handshakes.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name (FalconSensor.exe, MsMpEng.exe) and Parent Process ID. Exclude any network traffic or process creation events where the parent process is a known EDR service running under the SYSTEM account.

• Scenario: Automated Patch Management Deployment

  • Context: The IT Operations team utilizes Microsoft SCCM (Configuration Manager) to deploy monthly security patches. The deployment agent (ccmsetup.exe) often spawns child processes that establish outbound connections to update servers, mimicking the command-and-control behavior of a Remote Access Trojan (RAT) by querying external endpoints for patch manifests.
  • Filter/Exclusion: Filter out events where the Process Path contains C:\Windows\CCM and the Destination IP belongs to the internal SCCM site system range or known Microsoft update domains (*.microsoft.com). Additionally, exclude traffic occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: Legacy Remote Support Tools

  • Context: The Help Desk utilizes a legacy remote support tool like TeamViewer or AnyDesk installed on shared kiosk machines. These tools inherently function as RATs