This hunt hypothesis targets adversary behavior involving the deployment of DCRat remote access trojans by detecting seven specific indicators of compromise across network and endpoint telemetry. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications before they escalate into full-scale data exfiltration incidents.
Malware Family: DCRat Total IOCs: 7 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 5[.]230[.]201[.]242:1995 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 38[.]60[.]125[.]143:12599 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 178[.]16[.]53[.]193:9999 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 178[.]16[.]53[.]19:5022 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 172[.]94[.]44[.]154:7775 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 158[.]94[.]209[.]117:5022 | botnet_cc | 2026-07-09 | 75% |
| ip:port | 142[.]202[.]191[.]251:8624 | botnet_cc | 2026-07-09 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["172.94.44.154", "158.94.209.117", "178.16.53.19", "38.60.125.143", "5.230.201.242", "178.16.53.193", "142.202.191.251"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.94.44.154", "158.94.209.117", "178.16.53.19", "38.60.125.143", "5.230.201.242", "178.16.53.193", "142.202.191.251"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Enterprise Endpoint Management Scans (e.g., Microsoft Defender for Endpoint or CrowdStrike)
C:\Program Files\DCRat directory (or similar named folders) on thousands of endpoints. This activity generates network connections to internal update servers and file system reads that match the DCRat IOCs, particularly if the enterprise uses “DCRat” as a naming convention for specific deployment packages unrelated to the malware.MsMpEng.exe, csagent.exe) and Parent Process ID. Alternatively, exclude traffic originating from known internal IP ranges associated with the EDR management servers where these scans are orchestrated.Software Deployment via Configuration Management Tools (e.g., SCCM/MECM or Ansible)
HR and Finance departments using System Center Configuration Manager (SCCM). During the installation phase, the deployment agent (ccmexec.exe) or Ansible runner creates temporary files and initiates outbound connections that trigger the DCRat IOCs.ccmexec.exe, AnsibleRunner.exe, or TaskScheduler running a specific scheduled job (e.g., Job ID: Deploy-DCRat-Utility). Additionally, filter by User Context to exclude accounts belonging to the IT-Admins group performing bulk deployments.**Internal Development and