ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary activity involving the five specific indicators of compromise (IOCs) linked to the DCRat remote access tool, which is frequently utilized by threat actors for command and control operations within compromised networks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify early-stage infections and potential lateral movement before the malware establishes persistent footholds or exfiltrates sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`69[.]167[.]41[.]16:7000`	botnet_cc	2026-09-01	75%
ip:port	`207[.]56[.]7[.]37:12159`	botnet_cc	2026-09-01	75%
ip:port	`207[.]56[.]7[.]53:12159`	botnet_cc	2026-09-01	75%
ip:port	`194[.]58[.]47[.]81:5025`	botnet_cc	2026-09-01	75%
ip:port	`38[.]60[.]223[.]14:8848`	botnet_cc	2026-09-01	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["38.60.223.14", "207.56.7.37", "194.58.47.81", "69.167.41.16", "207.56.7.53"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["38.60.223.14", "207.56.7.37", "194.58.47.81", "69.167.41.16", "207.56.7.53"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Remote Administration via PowerShell or RDP
- Context: System administrators frequently use powershell.exe to query remote systems or manage configurations. If the DCRat hunt package includes IOCs related to specific process arguments, registry keys, or network connections often used by standard admin scripts (e.g., connecting to a central management server), these legitimate activities may trigger the rule.
- Filter/Exclusion: Exclude processes where ProcessName is powershell.exe, svchost.exe, or mstsc.exe AND UserAccount belongs to the Domain Admins or IT_Operations security group. Additionally, filter out connections destined for internal IP ranges (e.g., 10.x.x.x and 192.168.x.x) that match known management subnets.
Scenario: Scheduled Antivirus or EDR Scanning Jobs
- Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black, often run scheduled scans that generate specific network traffic patterns or registry modifications. If the DCRat IOCs overlap with signatures used by these security tools during their routine “heartbeat” or cloud synchronization tasks, false positives will occur.
- Filter/Exclusion: Create an exclusion rule for processes matching C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\Microsoft Defender\MsMpEng.exe, and C:\Program Files\Carbon Black\cb.exe. Filter out events where the ProcessCommandLine contains keywords like “scan”, “sync”, or ”