This rule detects the presence of known DCRat malware indicators, which are frequently used by adversaries to establish persistent remote access and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the malware from leveraging its capabilities to exfiltrate data or deploy additional payloads before traditional detections trigger.
Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 172[.]94[.]58[.]29:8848 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 143[.]92[.]61[.]232:8848 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 143[.]92[.]61[.]144:8848 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 143[.]92[.]61[.]231:8848 | botnet_cc | 2026-09-03 | 75% |
| ip:port | 102[.]220[.]160[.]117:8848 | botnet_cc | 2026-09-03 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["143.92.61.144", "143.92.61.232", "102.220.160.117", "143.92.61.231", "172.94.58.29"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.92.61.144", "143.92.61.232", "102.220.160.117", "143.92.61.231", "172.94.58.29"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to automatically deploy application updates, which involves creating temporary directories or files with names matching DCRat’s known IOCs (e.g., dc.exe, svchost.exe variants, or specific GUID-based folder names) during the build or deployment phase.
java.exe for Jenkins, node.exe for GitHub Actions, or docker.exe) and the file path resides within a standard build workspace directory (e.g., C:\Jenkins\workspace\, /home/jenkins/agent/, or C:\GitHub\workflows\).Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files or rotate logs, which inadvertently creates or moves a file with a name matching a DCRat IOC (such as config.dat or update.tmp) in a common temp directory like %TEMP% or C:\Windows\Temp.
DOMAIN\svc_backup or DOMAIN\svc_admin) and the file path is under a standard temporary or log directory (e.g., C:\Windows\Temp\, C:\ProgramData\Temp\, or C:\Logs\).Scenario: A security team performs a controlled vulnerability scan or penetration test using tools like Nmap, Metasploit, or custom Python scripts that drop small beaconing executables or configuration files with names resembling DCRat IOCs (e.g., beacon.exe, payload.bin) in a designated test VM or isolated network segment.