This hunt targets the presence of two specific indicators of compromise linked to the DCRat malware, which may indicate an adversary has established a foothold or is executing malicious payloads within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify potential intrusions early, allowing the SOC to isolate affected assets and mitigate the high-severity threat before it spreads or achieves its intended objectives.
Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 46[.]246[.]84[.]8:2003 | botnet_cc | 2026-09-09 | 75% |
| ip:port | 46[.]246[.]84[.]8:6490 | botnet_cc | 2026-09-09 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["46.246.84.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.246.84.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
InventorySync.exe) that periodically queries a specific internal API endpoint or connects to a known third-party update server. If the DCRat IOC list includes generic IP ranges or specific URL paths used by this vendor, the connection may be flagged.
svc-inventory-sync or the process InventorySync.exe when the destination port is 443 and the user-agent string matches LegacyApp/2.1.172.17.0.x) or a specific test domain (e.g., mock-api.internal.dev) might match a DCRat IOC if the IOC list includes broad subnet ranges or common test domains.
10.20.30.0/24 and the destination domain ends with .internal.dev, or exclude processes running under the dockerd or containerd service accounts./v1/telemetry, legitimate data uploads from the corporate proxy or agent may trigger the rule.
203.0.113.0/24) when the source process is chrome.exe or `