ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies potential Remote Access Trojan (RAT) activity by monitoring for specific Indicators of Compromise (IOCs) linked to unknown threat actors within the Azure Sentinel environment. Proactive hunting is essential because RATs often establish persistent backdoors that enable long-term data exfiltration and lateral movement, which may remain undetected until significant damage occurs.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["176.65.144.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.65.144.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["shift-api-control.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: Unknown RAT IOCs detection rule:

• Scenario: Scheduled Endpoint Security Scans

  • Context: The organization’s managed endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) performs daily deep scans. During these scans, the security agent injects a temporary monitoring process that communicates with external threat intelligence feeds to check file hashes against known RAT signatures. This traffic often mimics the behavior of an unknown Remote Access Trojan (RAT) by establishing new outbound connections to unknown IPs or domains not yet in the allow-list.
  • Suggested Filter/Exclusion: Create a rule exclusion based on the specific process name and parent process of the security agent.
    • Filter Logic: Exclude if Process Name contains "FalconSensor.exe" OR "MsMpEng.exe" AND Parent Process is "svchost.exe"
    • Action: Suppress alerts where the source IP matches the organization’s internal security management server range (e.g., 10.20.50.x).

• Scenario: Admin-Initiated Remote Management Sessions

  • Context: System administrators utilize remote management tools like Microsoft System Center Configuration Manager (SCCM) or Ivanti Neurons to push configuration updates or run scripts on a batch of workstations. These tools often establish persistent, long-lived connections to the central management server using ports and protocols that resemble RAT command-and-control (C2) channels. If the management server’s IP address is not explicitly whitelisted in the ThreatFox IOC database, these legitimate administrative sessions trigger “Unknown RAT” alerts.
  • Suggested Filter/Exclusion: Implement a destination-based exclusion for known internal management infrastructure.
    • Filter Logic: `Exclude if