ThreatFox: Unknown RAT IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are deploying an unknown Remote Access Trojan (RAT) by leveraging specific Indicators of Compromise to establish persistent command and control channels within the network. Proactive hunting for these IOCs in Azure Sentinel is critical because early detection of this unidentified RAT can prevent lateral movement and data exfiltration before traditional signature-based defenses recognize the threat.

IOC Summary

Malware Family: Unknown RAT Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Unknown RAT
let malicious_ips = dynamic(["38.255.40.44"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.255.40.44"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Unknown RAT
let malicious_domains = dynamic(["gals.kleenghjah.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Unknown RAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Unknown RAT IOCs rule in an enterprise environment:

• Internal Security Tool Updates & Scans

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne, frequently download new definition updates or perform scheduled deep scans. These activities often involve connecting to internal update servers or external vendor endpoints that may not yet be whitelisted in the ThreatFox IOC database, triggering alerts on unknown IP addresses or hash values associated with “RAT-like” behavior (e.g., persistent background processes).
  • Filter/Exclusion: Create a filter to exclude traffic and process execution originating from known EDR service accounts (e.g., NT SERVICE\DefenderSvc, CrowdStrike Falcon Service) and restrict the IOC match scope to exclude internal IP subnets dedicated to patch management servers.

• Automated Backup and Synchronization Jobs

  • Scenario: Scheduled enterprise backup solutions like Veeam Backup & Replication, Commvault, or cloud sync tools like Microsoft OneDrive for Business and Dropbox Business run automated synchronization jobs during off-hours. These tools establish persistent connections to remote storage gateways, often utilizing dynamic IP ranges or new container images that mimic the network behavior of a RAT (Remote Access Trojan) due to their continuous data exfiltration patterns.
  • Filter/Exclusion: Implement an exclusion rule based on specific process names and paths (e.g., C:\Program Files\Microsoft OneDrive\OneDrive.exe, VeeamAgent.exe) combined with a time-based filter that suppresses alerts for these processes during their known maintenance windows (e.g., 02:00–04:00 local time).

• **Software Deployment