This hunt targets the presence of four specific IOCs linked to the DCRat malware, which often indicates an active compromise or persistence mechanism within the environment. Proactively hunting for these indicators allows the SOC to identify and isolate affected assets before the adversary can leverage DCRat for lateral movement or data exfiltration.
Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 192[.]238[.]177[.]18:12159 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 192[.]238[.]177[.]14:12159 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 192[.]238[.]177[.]14:8848 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 128[.]90[.]112[.]54:7777 | botnet_cc | 2026-09-13 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["128.90.112.54", "192.238.177.14", "192.238.177.18"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.112.54", "192.238.177.14", "192.238.177.18"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legacy Application Patching via Scheduled Task: A legacy Java-based enterprise application (e.g., an internal ERP module) uses a scheduled task to download and execute a specific JAR file from a trusted internal repository. If the JAR file’s hash or path matches one of the DCRat IOCs (often associated with specific java.exe or rundll32.exe command-line patterns), this legitimate patching job will trigger the alert.
schtasks.exe or Task Scheduler and the working directory is within the known application installation path (e.g., C:\Program Files\InternalERP\).IT Admin Tooling with Generic Command-Line Arguments: System administrators frequently use generic command-line tools like powershell.exe or cmd.exe to run maintenance scripts. If an admin runs a script that invokes a specific binary (e.g., msiexec.exe or wmic.exe) with arguments that coincidentally match a DCRat IOC string (such as a specific URL or file name used in the malware’s C2 or payload), the rule fires.
Domain Admins or IT_Ops) and the process is launched from a standard administrative directory (e.g., C:\AdminTools\ or C:\Users\Public\Scripts\).Third-Party Software Update Mechanisms: Many third-party enterprise applications (e.g., antivirus, backup agents, or virtualization clients) use background services to check for updates by downloading executables or DLLs to temporary directories. If the update package’s filename or hash matches a DCRat IOC (which often targets common system binaries or specific temp file patterns), the update process is flagged. *