ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving six specific indicators of compromise (IOCs) linked to the DCRat remote access trojan, which is frequently used by threat actors for command and control operations. The SOC team should proactively search for these signatures in Azure Sentinel to identify early-stage infections that may evade standard signature-based detection, thereby preventing potential lateral movement or data exfiltration before they escalate into significant incidents.

IOC Summary

Malware Family: DCRat Total IOCs: 6 IOC Types: ip:port, sha256_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["128.90.105.164"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.105.164"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DCRat
let malicious_hashes = dynamic(["de9eba832e86277fb8d51cab9bd6e48cda9d9ae2d674497bfa2cd1f2864a60b6", "69595b33983894508509551bb0522d82e81b835025a78102d2dd631d0f590752", "369a504f71ba3c1831dadeb22ad55e90fd4df20d315e33eb5c77d6ebbd316685", "cf74b17c235f0eda9d67b3c6044c6b119c324ceb4296d37b68f22da32eb6d171", "802d280de5970703467d775fd8106e63a0e70469c3a3ec6902635b65bc3079cc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Administration via PowerShell

  • Context: System Administrators frequently use PowerShell.exe to query remote servers or execute scripts that match the DCRat network signature (e.g., specific User-Agent strings or TLS fingerprinting). This often occurs during routine patch management or inventory scans.
  • Suggested Filter/Exclusion: Exclude process paths where the executable is located in C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe and the parent process is a known admin account (e.g., DOMAIN\AdminUser) running on standard management workstations. Additionally, filter out traffic originating from specific “Jump Box” IP ranges used for remote access.

• Scenario: Scheduled Backup Jobs Utilizing DCRat-like Protocols

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize custom network protocols that mimic the IOCs of DCRat (specifically regarding connection persistence and heartbeat intervals) to communicate with their central console during nightly scheduled jobs.
  • Suggested Filter/Exclusion: Create a whitelist for process names Veeam.Backup.Service.exe or commvault.cmd when they initiate outbound connections on the specific ports associated with DCRat IOCs (e.g., port 8080, 443). Exclude alerts where the source IP belongs to the dedicated “Backup Infrastructure” subnet.

• Scenario: Endpoint Detection and Response (EDR) Agent Heartbeats

  • Context: Modern EDR agents such as CrowdStrike Falcon, SentinelOne, or Carbon Black maintain persistent connections