This hypothesis targets the presence of DCRat remote access Trojan indicators, which enable adversaries to establish persistent command-and-control channels for executing arbitrary commands on compromised hosts. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy RAT infections early, preventing attackers from leveraging the tool for lateral movement, data exfiltration, or further payload deployment within the environment.
Malware Family: DCRat Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 45[.]207[.]241[.]27:12159 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 45[.]207[.]241[.]47:8848 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 217[.]60[.]195[.]50:8848 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 217[.]60[.]195[.]50:1313 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 217[.]60[.]195[.]50:1453 | botnet_cc | 2026-09-15 | 75% |
| ip:port | 128[.]90[.]105[.]59:7777 | botnet_cc | 2026-09-15 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["45.207.241.27", "217.60.195.50", "128.90.105.59", "45.207.241.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.207.241.27", "217.60.195.50", "128.90.105.59", "45.207.241.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
teamviewer.exe, anydesk.exe) or where the connection originates from a trusted internal support subnet (e.g., 10.20.0.0/24).pywin32 scripts) that load custom DLLs or establish outbound connections to local test servers.
dev, test, or qa in your CMDB or asset inventory, or exclude processes originating from standard IDE directories (e.g., C:\Program Files\Microsoft Visual Studio\).vssvc.exe, ccmexec.exe, wsusclient.exe) or connections to known internal repository IPs (e.g., 192.168.10.50).