ThreatFox: Brute Ratel C4 IOCs

Hunt Hypothesis

This hunt targets adversary reconnaissance and initial access behaviors by correlating network traffic against four specific Indicators of Compromise linked to the Brute Ratel C4 threat actor. Proactively hunting for these IOCs in Azure Sentinel is critical to rapidly identify early-stage intrusions from this known group before they escalate into full-scale lateral movement or data exfiltration campaigns.

IOC Summary

Malware Family: Brute Ratel C4 Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`35[.]79[.]190[.]98:80`	botnet_cc	2026-07-04	100%
ip:port	`13[.]196[.]44[.]85:80`	botnet_cc	2026-07-04	100%
ip:port	`52[.]196[.]76[.]29:80`	botnet_cc	2026-07-04	100%
ip:port	`54[.]248[.]149[.]54:80`	botnet_cc	2026-07-04	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Brute Ratel C4
let malicious_ips = dynamic(["35.79.190.98", "13.196.44.85", "54.248.149.54", "52.196.76.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["35.79.190.98", "13.196.44.85", "54.248.149.54", "52.196.76.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Brute Ratel C4

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Brute Ratel C4 detection rule in an enterprise environment, along with suggested filters or exclusions:

Scheduled Vulnerability Scanning via Qualys or Tenable
- Scenario: The organization runs nightly vulnerability scans using tools like Qualys Cloud Agent or Tenable Nessus. These scanners often probe external IP ranges and specific ports (e.g., SSH on 22, RDP on 3389) to assess patch levels. If the Brute Ratel C4 IOCs include known public scanning IPs or specific port sequences used by these platforms, the detection logic will flag them as suspicious brute force attempts rather than authorized health checks.
- Filter/Exclusion: Create an exclusion rule for source IP ranges belonging to the vulnerability management platform (e.g., Qualys_External_IP_Range and Tenable_Scanner_Subnet) during the scheduled maintenance window (e.g., 02:00–04:00 UTC).
Automated Backup Replication Jobs
- Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault frequently initiate high-volume connection bursts to replicate data between on-premise servers and cloud storage (e.g., AWS S3, Azure Blob). These jobs often reuse specific authentication tokens or IP addresses that match the Brute Ratel C4 IOCs. The detection may misinterpret the rapid succession of successful connections from a single backup agent as a brute force attack pattern.
- Filter/Exclusion: Exclude traffic originating from the dedicated Backup Service Account (e.g., svc_backup_agent) or specific hostnames identified in the backup infrastructure (e.g., *.veeam-replica.local), ensuring that high-frequency connection counts from these sources do not trigger