ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hunt targets the presence of IOCs linked to an unidentified Remote Access Trojan (RAT), indicating a potential stealthy backdoor that allows adversaries to maintain persistent, remote control over compromised endpoints. Proactively hunting for these indicators in Azure Sentinel is critical because unknown RATs often operate below the radar of standard EDR detections, enabling attackers to exfiltrate data or deploy additional malware before traditional alerting mechanisms can identify the intrusion.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 11 IOC Types: url, domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["202.61.160.202", "64.224.17.70", "52.249.219.108"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["202.61.160.202", "64.224.17.70", "52.249.219.108"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["00vn1.top", "clash-verge-upgrade.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["http://52.249.219.108:3001/api/upload", "http://52.249.219.108:3001/ws", "https://d1u70y867zmoi6.cloudfront.net/helper", "http://18.136.197.129/init", "https://66.179.31.11/linux/linux_pwn.zip", "https://66.179.31.11/linux/mac_pwn.zip"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Scenario: A DevOps engineer uses WinSCP or FileZilla to transfer large log archives or build artifacts between on-premises servers and a cloud storage bucket, where the source IP or destination port matches one of the 11 IOCs (e.g., a specific high-numbered TCP port like 4455 or 5555 often used by RATs but also by custom internal tools).

  • Filter/Exclusion: Exclude known application service accounts (e.g., svc-devops, svc-ci-cd) and limit the rule to non-service accounts. Additionally, exclude connections originating from designated jump hosts or bastion servers (e.g., jump01.corp.local) that are expected to initiate outbound connections to various internal and external endpoints.

• Scenario: A legacy Java-based enterprise application (e.g., an old ERP or middleware component) uses a hardcoded socket connection to a specific internal database or message broker on a non-standard port (e.g., 12345) that coincidentally matches one of the ThreatFox IOCs. The process is a long-running service like java.exe or dotnet.exe.

  • Filter/Exclusion: Exclude processes known to be part of the legacy application stack, such as java.exe when running from the specific application directory (e.g., C:\Apps\LegacyERP\bin\) or dotnet.exe when the parent process is the application service. Alternatively, exclude the specific host:port combination if it is documented in the network inventory as a legitimate internal service.

• Scenario: A security team runs a periodic vulnerability scan or asset discovery tool (e.g., Nessus, Qualys, or a custom Python script) that probes various internal IPs and ports to map the network, triggering connections to ports associated with the RAT IOCs. The scanning tool runs