ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the four specific indicators of compromise (IOCs) linked to the DCRat remote access trojan to identify potential command-and-control communications or lateral movement within the network. A SOC team should proactively hunt for these signals in Azure Sentinel because early detection of DCRat infections is critical to preventing data exfiltration and unauthorized system control before the adversary establishes a persistent foothold.

IOC Summary

Malware Family: DCRat Total IOCs: 4 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["186.224.3.167", "103.182.16.169", "40.160.232.46"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["186.224.3.167", "103.182.16.169", "40.160.232.46"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - DCRat
let malicious_domains = dynamic(["azswaz.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently download patch definitions and update manifests from trusted vendor repositories. These downloads often match the specific file hashes or network destinations associated with DCRat’s command-and-control (C2) infrastructure, particularly if the enterprise uses a shared CDN that overlaps with known DCRat nodes.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name ccmsetup.exe (SCCM) or Microsoft.IntuneManagementService.exe. Additionally, exclude traffic originating from specific internal IP ranges dedicated to patch management servers if the IOC triggers are network-based.

• Scenario: Scheduled Backup Jobs Utilizing Third-Party Agents

  • Context: Enterprise backup solutions like Veeam, Commvault, or Acronis often run scheduled jobs during off-hours that involve heavy file I/O and external connectivity to cloud storage buckets. The DCRat IOCs may include specific directory paths (e.g., C:\ProgramData\...) or executable names that coincide with the backup agent’s temporary staging folders or service executables.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is a known backup service, such as Veeam.Backup.Service.exe or commvault_agent.exe. Implement a time-based filter to suppress alerts for these processes during defined maintenance windows (e.g., 02:00–06:00 local time).

• Scenario: Endpoint Detection and Response (EDR) Self-Scans

  • Context: The organization’s primary