ThreatFox: DCRat IOCs

Hunt Hypothesis

This hypothesis targets the presence of DCRat, a remote access Trojan that enables adversaries to establish persistent, stealthy control over compromised hosts for data exfiltration and command execution. Proactively hunting for these IOCs in Azure Sentinel is critical to identify early-stage infections and prevent attackers from leveraging this RAT to pivot within the network or escalate privileges before traditional detections trigger.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["82.23.246.148", "156.238.120.12"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["82.23.246.148", "156.238.120.12"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

• Legitimate Use of netsh for Network Configuration: Administrators frequently use netsh to configure network interfaces, proxies, or firewall rules during routine maintenance or new host onboarding. Since DCRat often abuses netsh to establish persistence or modify network settings, this can trigger the rule.

  • Filter/Exclusion: Exclude executions of netsh where the parent process is a known administrative tool (e.g., PowerShell.exe from C:\Windows\System32\WindowsPowerShell\v1.0\ or cmd.exe initiated by a service account) and the specific subcommand does not match known DCRat patterns (e.g., exclude netsh advfirewall or netsh interface unless accompanied by suspicious arguments like add portproxy).

• Scheduled Tasks for Log Rotation or Cleanup: Enterprise environments often use schtasks or Task Scheduler to run periodic jobs for log cleanup, disk space management, or backup verification. If these tasks invoke command-line tools that overlap with DCRat’s IOCs (such as cmd.exe or powershell.exe with specific arguments), they may be flagged.

  • Filter/Exclusion: Exclude executions where the command line matches known scheduled task paths (e.g., \Microsoft\Windows\... or custom enterprise paths like \Corp\LogCleanup) and the parent process is Task Scheduler (taskschd.mgr) or a known service.

• Software Deployment via Group Policy or SCCM: During mass software deployments (e.g., via Microsoft Endpoint Configuration Manager or Group Policy Preferences), scripts may execute commands that resemble DCRat’s persistence mechanisms, such as creating registry keys or copying binaries to standard locations.

  • Filter/Exclusion: Exclude events where the parent process is GpOUtil.exe, CcmExec.exe, or `