ThreatFox: DCRat IOCs

Hunt Hypothesis

This hunt detects adversary activity involving known DCRat remote access trojan indicators to identify potential command-and-control communications or lateral movement within the network. A SOC team should proactively search for these IOCs in Azure Sentinel because early detection of this high-severity threat enables rapid containment before attackers can establish persistent footholds and exfiltrate sensitive data.

IOC Summary

Malware Family: DCRat Total IOCs: 2 IOC Types: url, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["172.174.128.128"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.174.128.128"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - DCRat
let malicious_urls = dynamic(["http://cc893886.tw1.ru/L1nc0In.php"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — DCRat

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Legitimate Remote Desktop Administration via RDP

  • Context: Enterprise administrators frequently use tools like Microsoft Remote Desktop (mstsc.exe) or third-party solutions like BeyondTrust to connect to servers. If the DCRat IOCs include specific file hashes or network connections commonly used by these legitimate admin tools, routine login sessions may trigger the alert.
  • Suggested Filter/Exclusion: Create a process-based exclusion for mstsc.exe and beyondtrust-agent.exe. Additionally, exclude traffic originating from known internal IP ranges (e.g., the “Admin Workstation” subnet) that matches the DCRat network signature.

• Scenario: Scheduled Backup Jobs Utilizing Cloud Storage

  • Context: Automated backup solutions such as Veeam Backup & Replication or Acronis Cyber Protect often initiate scheduled jobs during off-hours to upload data to cloud repositories. These tools may generate file hashes or network patterns that overlap with DCRat’s IOCs, particularly if the backup agent communicates with a specific external endpoint used by the threat intelligence feed.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is VeeamTransportService.exe or AcronisBackupAgent.exe. Implement a time-based filter to suppress alerts for these processes during known maintenance windows (e.g., 02:00–04:00 local time).

• Scenario: Software Deployment via Endpoint Management Tools

  • Context: IT teams use Microsoft Intune, SCCM (Configuration Manager), or Jamf to push software updates and patches. The deployment agents often download installation