ThreatFox: DarkVision RAT IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving three specific Indicators of Compromise (IOCs) linked to the DarkVision Remote Access Trojan (RAT), which attackers use to establish persistent access and execute command-and-control communications within compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical because early identification of DarkVision RAT presence allows the SOC team to rapidly isolate affected systems, preventing lateral movement and potential data exfiltration before the adversary can fully entrench its capabilities.

IOC Summary

Malware Family: DarkVision RAT Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkVision RAT
let malicious_hashes = dynamic(["2a67ec9b4db3954e30b1fa26fe87dea4f89ce4d011415e00d48f3200c9fe1f88", "1b0614ebdc81d0a98e5c8c6013d6a0596be2ec2d", "1150457afc7e499c3937a0f2bc430c29"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DarkVision RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DarkVision RAT IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Endpoint Protection Scanning of Quarantine Archives

  • Context: Enterprise EDR agents (e.g., CrowdStrike Falcon or Microsoft Defender) periodically scan the Quarantine folder where previously isolated DarkVision artifacts are stored. The detection logic may trigger because the IOCs exist within these static archives rather than active execution.
  • Filter/Exclusion: Exclude file paths containing \ProgramData\Microsoft\Windows Defender\Support\Quarantine\ or specific EDR quarantine directories from the rule scope. Additionally, filter out events where the ProcessName is the EDR service itself (e.g., MsMpEng.exe, FalconSensorService) and the ParentImage indicates a scheduled maintenance job.

• Scenario: Legacy Admin Script Execution via Scheduled Tasks

  • Context: IT Operations teams often utilize PowerShell scripts to perform nightly inventory or configuration checks. If these scripts reference specific DarkVision IOCs (perhaps as part of a compliance check or legacy tool integration) and are triggered by the Windows Task Scheduler, they may mimic RAT behavior.
  • Filter/Exclusion: Create an exclusion for processes spawned by TaskScheduler.exe where the command line contains known internal script paths (e.g., C:\Scripts\Ops\DailyCheck.ps1). Filter events where the UserAccount is a service account with the prefix svc_ or admin_ops and the process duration exceeds 60 seconds, indicating a batch job rather than an interactive user session.

• Scenario: Software Deployment via Configuration Management Tools

  • Context: During mass software deployments using tools like SCCM (System Center Configuration Manager) or Ansible, agents