ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) infections by monitoring network and endpoint activity against a curated set of 26 unknown Indicators of Compromise (IOCs). Proactive hunting for these specific IOCs in Azure Sentinel is critical to uncover stealthy adversary presence that may evade standard signature-based defenses, enabling early containment before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 26 IOC Types: domain, url, ip:port

Type	Value	Threat Type	First Seen	Confidence
domain	sel.cantdown.su	botnet_cc	2026-08-27	100%
domain	sos.cantdown.su	botnet_cc	2026-08-27	100%
domain	swi.cantdown.su	botnet_cc	2026-08-27	100%
domain	u550.cantdown.su	botnet_cc	2026-08-27	100%
domain	war.cantdown.su	botnet_cc	2026-08-27	100%
domain	2280.cantdown.su	botnet_cc	2026-08-27	100%
domain	cyx0.cantdown.su	botnet_cc	2026-08-27	100%
domain	dod.cantdown.su	botnet_cc	2026-08-27	100%
domain	fso.cantdown.su	botnet_cc	2026-08-27	100%
domain	gli.cantdown.su	botnet_cc	2026-08-27	100%
domain	kul.cantdown.su	botnet_cc	2026-08-27	100%
domain	mrr.cantdown.su	botnet_cc	2026-08-27	100%
domain	nef.cantdown.su	botnet_cc	2026-08-27	100%
ip:port	159[.]223[.]110[.]159:54321	botnet_cc	2026-08-27	75%
domain	windowskernel.lol	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/mods/api/log-download	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/ws	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/?p=	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/get/config	botnet_cc	2026-08-27	100%
url	hxxps://windowskernel.lol/babayla/zor/yarisirlar/	botnet_cc	2026-08-27	100%
url	hxxps://yeter.lol/mods/api/log-download	botnet_cc	2026-08-27	100%
url	hxxps://yeter.lol/ws	botnet_cc	2026-08-27	100%
url	hxxps://yeter.lol/get/config	botnet_cc	2026-08-27	100%
url	hxxps://yeter.lol/?p=	botnet_cc	2026-08-27	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["159.223.110.159"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.223.110.159"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["sel.cantdown.su", "sos.cantdown.su", "swi.cantdown.su", "u550.cantdown.su", "war.cantdown.su", "2280.cantdown.su", "cyx0.cantdown.su", "dod.cantdown.su", "fso.cantdown.su", "gli.cantdown.su", "kul.cantdown.su", "mrr.cantdown.su", "nef.cantdown.su", "windowskernel.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://windowskernel.lol/", "https://windowskernel.lol/mods/api/log-download", "https://windowskernel.lol/ws", "https://windowskernel.lol/?p=", "https://windowskernel.lol/get/config", "https://windowskernel.lol/babayla/zor/yarisirlar/", "https://yeter.lol/mods/api/log-download", "https://yeter.lol/ws", "https://yeter.lol/get/config", "https://yeter.lol/?p=", "https://yeter.lol/babayla/zor/yarisirlar/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are the documented false positive scenarios and corresponding exclusion strategies for the ThreatFox: Unknown RAT IOCs detection rule:

• Scenario: Enterprise Endpoint Protection Scans

  • Context: The organization’s primary endpoint security suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs scheduled real-time scans that generate network connections to update servers and cloud telemetry endpoints. These connections often match the generic IOCs associated with Unknown RATs due to similar port usage and certificate patterns.
  • Filter/Exclusion: Create a rule exclusion based on the Process_Name field, filtering out processes belonging to known security agents (e.g., FalconSensor.exe, MsMpEng.exe) when they initiate outbound connections to approved update domains (e.g., *.falcon.crowdstrike.com, *.microsoft.com).

• Scenario: Automated Backup and Archive Jobs

  • Context: Scheduled nightly backup jobs running via Veeam Backup & Replication or Rubrik utilize specific executable paths to transfer data to cloud storage. These jobs often establish persistent connections that mimic the command-and-control (C2) behavior of Remote Access Trojans, triggering the 26 IOC set.
  • Filter/Exclusion: Implement a filter excluding traffic where the Parent_Process_Name matches known backup services (e.g., Veeam.Backup.Service.exe, rubrik-agent) and the destination IP ranges fall within the organization’s approved cloud storage CIDR blocks.

• Scenario: DevOps CI/CD Pipeline Execution

  • Context: During active build cycles, Jenkins or Azure DevOps Agents on build servers execute scripts that download dependencies from public repositories (e.g., Maven Central, npm registry). These agents frequently spawn temporary processes with network behaviors indistinguishable from RAT activity.