ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the five specific indicators of compromise (IOCs) linked to the DCRat remote access trojan, which is frequently used by threat actors for persistent command and control operations. The SOC team should proactively hunt for these signals in Azure Sentinel because early identification of DCRat presence allows for immediate containment of compromised endpoints before adversaries can establish deep footholds or exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`45[.]192[.]169[.]254:8848`	botnet_cc	2026-08-29	75%
ip:port	`38[.]60[.]252[.]124:80`	botnet_cc	2026-08-29	75%
ip:port	`38[.]60[.]252[.]124:8848`	botnet_cc	2026-08-29	75%
ip:port	`128[.]90[.]105[.]118:8624`	botnet_cc	2026-08-29	75%
ip:port	`103[.]98[.]18[.]238:8660`	botnet_cc	2026-08-29	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["128.90.105.118", "45.192.169.254", "38.60.252.124", "103.98.18.238"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.105.118", "45.192.169.254", "38.60.252.124", "103.98.18.238"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Scheduled Endpoint Protection Scans
- Context: Enterprise endpoint protection suites (e.g., Microsoft Defender for Endpoint, CrowdStrike Falcon) often perform scheduled deep scans that generate network connections matching DCRat’s C2 beacon patterns. These scans may query specific update servers or cloud storage endpoints that overlap with the 5 IOCs in the hunt package.
- Filter/Exclusion: Create a filter to exclude traffic originating from known security management nodes (e.g., Host_Process_Image contains “MsMpEng.exe” or “csfalcon.exe”) and restrict the alert scope to non-scan hours (09:00–17:00) unless the connection duration exceeds 5 minutes.
Scenario: Legitimate Cloud Backup and Sync Operations
- Context: Automated backup jobs using tools like Veeam, Rubrik, or Microsoft OneDrive for Business frequently establish persistent connections to cloud storage endpoints that share IP ranges or certificate hashes with DCRat infrastructure. These legitimate sync processes often trigger the “data exfiltration” logic within the rule.
- Filter/Exclusion: Exclude traffic where the destination domain matches known enterprise backup providers (e.g., *.veeam.com, *.office365.com) and add a condition to ignore alerts if the source process is a recognized backup agent (e.g., vrb.exe, OneDrive.exe).
Scenario: Third-Party Remote Support Sessions
- Context: IT Helpdesk teams utilize remote support tools such as TeamViewer, AnyDesk, or ConnectWise ScreenConnect to troubleshoot user issues. These tools often initiate outbound connections that mimic the DCRat