This hunt hypothesis targets adversaries deploying the DCRat remote access trojan by actively searching for eight specific indicators of compromise across endpoint and network telemetry within Azure Sentinel. Proactively hunting for these IOCs is critical to detect early-stage command-and-control communications before they escalate into full-scale data exfiltration or lateral movement incidents.
Malware Family: DCRat Total IOCs: 8 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 156[.]234[.]43[.]100:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 156[.]234[.]43[.]101:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 156[.]234[.]43[.]102:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 156[.]234[.]43[.]98:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 156[.]234[.]43[.]99:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 137[.]220[.]152[.]131:8848 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 137[.]220[.]152[.]132:12159 | botnet_cc | 2026-07-11 | 75% |
| ip:port | 172[.]174[.]154[.]130:1024 | botnet_cc | 2026-07-11 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["156.234.43.98", "156.234.43.100", "156.234.43.102", "137.220.152.132", "172.174.154.130", "156.234.43.101", "137.220.152.131", "156.234.43.99"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.234.43.98", "156.234.43.100", "156.234.43.102", "137.220.152.132", "172.174.154.130", "156.234.43.101", "137.220.152.131", "156.234.43.99"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:
Enterprise Endpoint Protection Scans
C:\Program Files\DCRat directory. During this process, the scanner generates network connections to known DCRat update servers or internal repositories that match the rule’s IOCs, mimicking active malware communication.SYSTEM, NT AUTHORITY\LOCAL SERVICE) and restrict alerts to exclude the standard EDR process names (csfalcon.exe, MsMpEng.exe).Software Deployment via SCCM/Intune
ccmexec.exe) downloads and installs the software, triggering network connections to the same IOCs defined in the rule during the installation phase.ccmexec.exe or Microsoft.Windows.IntuneManagementAgent.exe. Additionally, exclude traffic from the specific IP ranges of the Software Update Point (SUP) servers used for distribution.Scheduled Backup and Replication Jobs