ThreatFox: DCRat IOCs

Hunt Hypothesis

The detection identifies potential DCRat malware activity through suspicious network communications associated with known malicious IP:port pairs, indicating possible remote access and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats that leverage DCRat for command and control operations.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["178.16.54.248", "205.209.99.237"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.54.248", "205.209.99.237"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

• Scenario: Legitimate scheduled job using crontab to run system maintenance scripts
  Filter/Exclusion: process.parent_process_name != "crontab" or process.command_line NOT LIKE '%/bin/crontab%'

• Scenario: Admin using tcpdump to monitor network traffic for troubleshooting
  Filter/Exclusion: process.name != "tcpdump" or process.command_line NOT LIKE '%tcpdump%'

• Scenario: System update via yum or apt that connects to a known IP for package downloads
  Filter/Exclusion: process.name IN ("yum", "apt") or process.command_line LIKE '%update%'

• Scenario: Remote administration using ssh to connect to a server for support
  Filter/Exclusion: process.name == "ssh" and process.parent_process_name == "sshd" or process.command_line LIKE '%ssh -p %'

• Scenario: Database backup using mysqldump that connects to a remote server for offsite storage
  Filter/Exclusion: process.name == "mysqldump" or process.command_line LIKE '%mysqldump --host=%'