ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This detection identifies adversary behavior characterized by the execution of unknown Remote Access Trojan (RAT) indicators that may signal a stealthy initial foothold or lateral movement attempt within the network. Proactively hunting for these ThreatFox IOCs in Azure Sentinel is critical to rapidly isolate compromised endpoints and prevent data exfiltration before the RAT establishes persistent command-and-control channels.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 12 IOC Types: ip:port, domain

Type	Value	Threat Type	First Seen	Confidence
ip:port	`163[.]245[.]210[.]240:4521`	botnet_cc	2026-07-15	75%
domain	`carcarcarla22.twilightparadox.com`	botnet_cc	2026-07-15	100%
ip:port	`109[.]122[.]18[.]38:4525`	botnet_cc	2026-07-15	75%
ip:port	`64[.]89[.]160[.]127:4561`	botnet_cc	2026-07-15	75%
ip:port	`133[.]18[.]107[.]191:4449`	botnet_cc	2026-07-15	75%
ip:port	`77[.]239[.]125[.]25:5041`	botnet_cc	2026-07-15	75%
ip:port	`185[.]69[.]122[.]37:443`	botnet_cc	2026-07-15	75%
ip:port	`185[.]69[.]123[.]172:443`	botnet_cc	2026-07-15	75%
ip:port	`137[.]184[.]133[.]198:443`	botnet_cc	2026-07-15	75%
ip:port	`104[.]131[.]86[.]222:443`	botnet_cc	2026-07-15	75%
ip:port	`77[.]91[.]123[.]220:443`	botnet_cc	2026-07-15	75%
ip:port	`176[.]123[.]9[.]22:443`	botnet_cc	2026-07-15	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["185.69.122.37", "133.18.107.191", "104.131.86.222", "64.89.160.127", "77.91.123.220", "109.122.18.38", "163.245.210.240", "185.69.123.172", "77.239.125.25", "137.184.133.198", "176.123.9.22"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.69.122.37", "133.18.107.191", "104.131.86.222", "64.89.160.127", "77.91.123.220", "109.122.18.38", "163.245.210.240", "185.69.123.172", "77.239.125.25", "137.184.133.198", "176.123.9.22"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["carcarcarla22.twilightparadox.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled

References

ThreatFox — Unknown RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Unknown RAT IOCs detection rule, tailored for a legitimate enterprise environment:

Endpoint Antivirus Signature Updates via Scheduled Tasks
- Scenario: The enterprise’s managed endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender) performs nightly signature and engine updates. These updates often download new executable components or DLLs that contain embedded network traffic patterns resembling Remote Access Trojans (RATs), specifically triggering connections to known update servers with high entropy payloads.
- Filter/Exclusion: Create an exclusion for the specific process names of the EDR agents (e.g., C:\Program Files\CrowdStrike\fs.exe, C:\Windows\System32\MpCmdRun.exe) and their associated update service accounts (e.g., NT AUTHORITY\SYSTEM or a dedicated svc-antivirus-update account) when connecting to the vendor’s known CDN IP ranges.
IT Admin Remote Management Sessions
- Scenario: System administrators utilize remote management tools like Microsoft SCCM (Configuration Manager), Ivanti, or TeamViewer to deploy patches or troubleshoot workstations. These sessions often establish persistent, encrypted connections with command-and-control (C2) characteristics that mimic RAT behavior, particularly when the admin workstation connects from a non-standard subnet or uses a dynamic IP address not yet whitelisted in the ThreatFox feed.
- Filter/Exclusion: Exclude traffic originating from the “IT-Admins” Active Directory security group and destination ports associated with remote management protocols (e.g., TCP 49389 for SCCM, TCP 5938 for TeamViewer) when the source IP is within the corporate DMZ or internal management VLAN.
Software Deployment via Package Managers