ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt hypothesis detects adversary activity involving the DCRat remote access trojan by identifying specific indicators of compromise such as unique file hashes and network connections within the Azure Sentinel environment. Proactively hunting for these IOCs is critical because DCRat enables attackers to maintain persistent, stealthy control over compromised endpoints, allowing them to exfiltrate sensitive data or execute lateral movement before traditional alerts trigger.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["45.142.30.157", "77.110.109.229", "46.246.6.27"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.142.30.157", "77.110.109.229", "46.246.6.27"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Legitimate Backup Agent Communication

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault often utilize the same ports (e.g., TCP 80/443) and specific hash signatures found in DCRat IOCs to communicate with their management consoles. The detection logic may flag these routine heartbeat signals as malicious DCRat activity.
  • Filter/Exclusion: Create a rule exclusion based on the specific process name VeeamAgent.exe or commvault_agent_service. Additionally, filter out network traffic originating from known backup server IP ranges (e.g., 10.50.20.x) communicating with the central management node.

• Scenario: Scheduled PowerShell Maintenance Jobs

  • Context: IT Operations teams frequently deploy scheduled tasks using Windows Task Scheduler to run PowerShell scripts for patch verification or log rotation. If these scripts invoke external commands or download configuration files from internal repositories, they may match DCRat’s IOCs regarding process creation and network connections.
  • Filter/Exclusion: Exclude events where the parent process is TaskScheduler.exe (PID 4) and the command line contains specific keywords like “Maintenance” or “PatchCheck.” Alternatively, whitelist the specific hash of the internal PowerShell script used for these tasks within the detection logic.

• Scenario: Endpoint Detection & Response (EDR) Scans

  • Context: Internal security tools such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform periodic deep scans that generate file hashes and network flows identical to DCRat’s signature. The EDR agents