ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific Indicators of Compromise (IOCs) linked to the DCRat remote access trojan, which is frequently used by threat actors for command and control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections and mitigate potential lateral movement before adversaries establish persistent footholds within the environment.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["81.68.249.199", "128.90.105.217"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["81.68.249.199", "128.90.105.217"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: DCRat IOCs detection rule:

• Scenario: Legitimate RMM Agent Communication

  • Context: Enterprise Remote Monitoring and Management (RMM) tools like ManageEngine Desktop Central, NinjaOne, or PDQ Deploy often utilize the same communication ports and hash signatures as DCRat to push updates, inventory data, and execute remote scripts. These agents frequently generate network traffic and file hashes that match the rule’s IOCs during scheduled maintenance windows (e.g., nightly backups).
  • Suggested Filter: Create an exclusion based on the Process Name or Parent Process Name. Add specific RMM agent executables (e.g., DesktopCentralAgent.exe, NinjaOne.Agent.Service.exe) to a whitelist, ensuring alerts are suppressed only when these processes initiate the matching network connections.

• Scenario: Scheduled PowerShell Automation Tasks

  • Context: IT Operations teams often run scheduled Task Scheduler jobs that execute complex PowerShell scripts for patch management or configuration drift analysis. If these scripts invoke PowerShell.exe to download manifests or query external APIs, the resulting network flow and file creation events may mimic DCRat’s command-and-control behavior, particularly if the script uses standard HTTP/HTTPS libraries with similar hash signatures.
  • Suggested Filter: Implement a logic check on the Task Name field within the Event Log or SIEM data. Exclude alerts where the parent process is SchTasks.exe (Windows Task Scheduler) and the command line contains keywords specific to internal automation scripts (e.g., -ExecutionPolicy Bypass, specific script paths like C:\Scripts\PatchManagement\).

• Scenario: Cloud Backup and Synchronization Services

  • Context: Enterprise backup solutions such as Veeam Agent, **Rub