ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving the DCRat remote access trojan by monitoring for specific indicators of compromise such as known malicious hashes and network connections. Proactive hunting in Azure Sentinel is critical to identify early-stage infections that may evade standard signature-based detection, allowing the SOC team to isolate compromised endpoints before lateral movement occurs.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["178.16.52.100", "207.89.17.21"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.52.100", "207.89.17.21"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Backup Operations via Veeam or Commvault

  • Context: Enterprise backup agents (e.g., Veeam Agent, Commvault) frequently communicate with central management servers using specific ports and protocols that may match DCRat’s command-and-control (C2) signatures. If the backup server IP or the agent’s process hash overlaps with known DCRat IOCs, legitimate backup traffic will trigger alerts.
  • Filter/Exclusion: Create a whitelist exclusion for processes running under VeeamAgent.exe and commvault_service.exe. Additionally, exclude network connections originating from the dedicated “Backup Subnet” (e.g., 10.50.x.x) or specific backup server FQDNs that are known to be trusted.

• Scenario: Scheduled PowerShell Script Execution for Patch Management

  • Context: IT Operations teams often run scheduled PowerShell jobs (via Task Scheduler) to deploy patches or gather inventory data. These scripts frequently invoke powershell.exe with arguments containing encoded commands or external URL requests that mimic DCRat’s C2 behavior, especially if the script downloads manifests from a public repository matching DCRat IOCs.
  • Filter/Exclusion: Exclude alerts where the parent process is TaskSchedulerService and the command line contains specific keywords like -ExecutionPolicy Bypass or references to internal patch management URLs (e.g., *.patch.enterprise.local). Implement a filter allowing traffic from known administrative workstations during maintenance windows.

• Scenario: Endpoint Detection and Response (EDR) Telemetry

  • Context: Modern EDR solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne constantly