This rule detects the presence of known indicators of compromise associated with unidentified Remote Access Trojans (RATs), signaling potential unauthorized remote control or data exfiltration by an adversary. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy malware infections early, as unknown RATs often lack distinct behavioral signatures and can persist undetected until they establish a foothold for lateral movement or payload delivery.
Malware Family: Unknown RAT Total IOCs: 4 IOC Types: ip:port, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 729454cfdc30e2cce222f0a6c67adfd268ac8971068fdef72477e212497f2a2d | payload | 2026-09-07 | 75% |
| ip:port | 138[.]199[.]38[.]136:4522 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 102[.]129[.]180[.]86:4521 | botnet_cc | 2026-09-07 | 75% |
| ip:port | 91[.]92[.]40[.]108:9111 | botnet_cc | 2026-09-07 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["91.92.40.108", "102.129.180.86", "138.199.38.136"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.40.108", "102.129.180.86", "138.199.38.136"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Unknown RAT
let malicious_hashes = dynamic(["729454cfdc30e2cce222f0a6c67adfd268ac8971068fdef72477e212497f2a2d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
C:\Program Files\LegacyERP\bin\) and the user account belongs to the AppAdmins group.BackupVerify.bat) executed by the svc-backup service account runs a checksum verification tool that temporarily loads a shared library with a hash previously seen in a low-fidelity ThreatFox feed entry.
Task Scheduler (taskschd.msc or svchost.exe with Tasks service) and the user is svc-backup.msiexec.exe, setup.exe) or a known package manager (winget, choco) and the file location is within the standard plugin/extension directories (e.g., C:\ProgramData\MonitoringTool\plugins\).