ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt targets the presence of DCRat malware indicators, a high-severity threat known for establishing persistent command-and-control channels through domain fronting and DNS tunneling. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the malware from exfiltrating sensitive data or executing further lateral movement within the environment.

IOC Summary

Malware Family: DCRat Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["128.90.105.161", "194.110.172.193", "46.246.4.10"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["128.90.105.161", "194.110.172.193", "46.246.4.10"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

• Scenario: A DevOps team deploys a custom internal monitoring agent or a specific version of a third-party security tool (e.g., CrowdStrike Falcon or Carbon Black) that shares a common hash or file path with one of the DCRat IOCs due to similar build structures or naming conventions.
  • Filter/Exclusion: Exclude alerts where the source process is signed by a known internal CA or vendor (e.g., Microsoft, CrowdStrike, Carbon Black) and the file location resides in standard installation directories like C:\Program Files\ or C:\ProgramData\.
• Scenario: An IT administrator runs a scheduled PowerShell script to clean up temporary files or rotate logs, which inadvertently creates a file with the same name or hash as a DCRat IOC in a temporary directory (%TEMP% or C:\Windows\Temp) before it is moved or deleted.
  • Filter/Exclusion: Exclude detections where the file path contains Temp, Temporary, or Logs and the parent process is a standard system utility like PowerShell.exe, cmd.exe, or a known internal service account running under a scheduled task.
• Scenario: A developer testing a new application build on a jump host or CI/CD runner creates a debug binary or test artifact that matches the filename or hash of a DCRat IOC, particularly if the build process uses generic names like update.exe or helper.dll.
  • Filter/Exclusion: Exclude alerts originating from user accounts with Dev, CI, Build, or Test in their group membership, or where the file path includes Build, Artifacts, Workspace, or Project directories.
• Scenario: A legacy line-of-business application or a specific vendor plugin (e.g., for document management or ERP systems) uses a DLL or