ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Remote Access Trojan (RAT) activity by monitoring for three specific Indicators of Compromise (IOCs) linked to unknown threat actors. Proactively hunting for these signals in Azure Sentinel is critical to rapidly detect early-stage lateral movement and command-and-control communications before adversaries establish persistent access within the network.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 3 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["64.89.160.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.89.160.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["s33mon3y.noip.at", "222align.noip.at"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Unknown RAT IOCs detection rule in a legitimate enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: During scheduled maintenance windows, System Center Configuration Manager (SCCM) or Microsoft Intune pushes new endpoint protection agents or updates to the fleet. These deployments often generate multiple IOCs (e.g., msiexec.exe, ccmsetup.exe) that mimic RAT behavior by establishing persistent connections and modifying registry keys for telemetry.
  • Filter/Exclusion: Exclude processes where the parent process is ccmsetup.exe or Microsoft.IntuneManagementExtension.exe running under the SYSTEM account, specifically during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Cloud Backup Agent Synchronization

  • Context: Enterprise backup solutions like Veeam Endpoint Agent or Rubrik Backup perform daily synchronization tasks. These agents frequently spawn child processes to scan file systems and upload metadata, triggering IOCs related to network connectivity and file system monitoring that resemble Remote Access Trojans.
  • Filter/Exclusion: Create a whitelist for the binary hash of Veeam.Backup.Agent.exe and Rubrik.Central.Service.exe, excluding any alerts where the process command line contains keywords like “sync,” “backup,” or “snapshot.”

• Scenario: Scheduled PowerShell Health Checks

  • Context: IT Operations teams utilize scheduled Task Scheduler jobs to run custom PowerShell scripts (powershell.exe) that query system health, check service status, and report metrics. These scripts often invoke network requests and modify local configuration files, generating IOCs indistinguishable from RAT activity.
  • Filter/Exclusion: Exclude alerts where the process name is `powershell.exe