This rule detects the presence of DCRat, a remote access trojan that enables adversaries to establish persistent control and execute arbitrary commands on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify stealthy backdoors before they are leveraged for lateral movement or data exfiltration, reducing the window of exposure for high-severity threats.
Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 61[.]158[.]61[.]184:8848 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 45[.]202[.]0[.]24:12159 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 45[.]202[.]0[.]25:12159 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 45[.]202[.]0[.]25:8848 | botnet_cc | 2026-09-11 | 75% |
| ip:port | 223[.]130[.]11[.]38:8848 | botnet_cc | 2026-09-11 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["61.158.61.184", "45.202.0.25", "45.202.0.24", "223.130.11.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["61.158.61.184", "45.202.0.25", "45.202.0.24", "223.130.11.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
dcrat.exe or a renamed variant) on a jump host or management server to validate a new detection rule or test endpoint protection (EDR) response.
powershell.exe initiated by splunkd.exe, crowdagent.exe, or carbonblack.exe) or where the user account belongs to the SecurityOps or ITAdmins group.setup.exe for a specific CRM or ERP system) bundles a component that shares the same hash, name, or behavioral signature as the DCRat IOCs due to shared libraries or similar obfuscation techniques.
C:\Program Files\LegacyApp\bin\dcrat.dll or C:\Program Files\VendorTool\installer\setup.exe) and exclude events where the image path matches these known locations.Task Scheduler task named NightlyBackup or LogRotation) runs a script or binary that temporarily downloads or extracts a utility matching the DCRat IOC hash to perform disk cleanup or log compression.
schtasks.exe or taskschd.msi and the user account is a service account (e.g., svc_backup, svc_maintenance) or belongs to the ServiceAccounts AD group.