ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known indicators of compromise associated with the “Unknown RAT” malware, which typically establishes remote access and control over compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected hosts early, preventing the adversary from leveraging the RAT for lateral movement, data exfiltration, or persistence within the environment.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 3 IOC Types: domain, url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["185.162.75.152"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.162.75.152"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["truspanel.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Unknown RAT
let malicious_urls = dynamic(["https://45.141.148.134:2002/AymxbQ"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

• Legacy Application Maintenance via Scheduled Tasks

  • Scenario: An IT operations team uses schtasks or Windows Task Scheduler to run a legacy line-of-business application installer or updater that includes a known hash or file path associated with the “Unknown RAT” IOCs. This is common in environments with older, unpatched software that hasn’t been replaced.
  • Filter/Exclusion: Exclude events where the parent process is schtasks.exe or Task Scheduler and the user account belongs to a service account or a specific “App Maintenance” security group.

• Third-Party Vendor Support Sessions

  • Scenario: A vendor engineer connects via RDP or a remote support tool (like TeamViewer or AnyDesk) and executes a diagnostic script or utility from a temporary directory (%TEMP% or C:\Users\Public) that matches one of the IOCs. These tools often drop helper executables that may share attributes with known RATs.
  • Filter/Exclusion: Correlate the alert with recent RDP logon events or known remote support tool processes (e.g., teamviewer.exe, anydesk.exe) as the parent process. Exclude if the user account is in a “Vendor Support” group and the execution path is within a standard temp or public folder.

• Security Tooling and EDR Agents

  • Scenario: The organization’s EDR or AV agent (e.g., CrowdStrike, SentinelOne, or Carbon Black) performs a self-test or drops a temporary scanner binary that matches the IOC hash or path. Alternatively, a security team runs a manual YARA scan or memory dump tool that creates a file matching the IOC.
  • Filter/Exclusion: Exclude alerts where the parent process is a known EDR/AV agent executable (e.g., csagent.exe, `sent