ThreatFox: DCRat IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of DCRat remote administration tools, specifically looking for network connections or process activity matching four known Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage lateral movement and command-and-control communications before they escalate into a full-scale compromise.

IOC Summary

Malware Family: DCRat Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`23[.]27[.]201[.]213:8848`	botnet_cc	2026-07-02	75%
ip:port	`143[.]92[.]43[.]160:8848`	botnet_cc	2026-07-02	75%
ip:port	`143[.]92[.]43[.]241:8848`	botnet_cc	2026-07-02	75%
ip:port	`143[.]92[.]43[.]246:8848`	botnet_cc	2026-07-02	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - DCRat
let malicious_ips = dynamic(["143.92.43.160", "143.92.43.246", "143.92.43.241", "23.27.201.213"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["143.92.43.160", "143.92.43.246", "143.92.43.241", "23.27.201.213"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — DCRat

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: DCRat IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

Legacy Remote Management Tool Updates
- Scenario: The organization utilizes SolarWinds RMM or ManageEngine Endpoint Central to push firmware updates. During a scheduled maintenance window, the agent on legacy Windows 10/Server 2016 machines communicates with an external update repository that shares a specific IP range or domain hash with DCRat’s command-and-control (C2) infrastructure.
- Filter/Exclusion: Create an exclusion for traffic originating from the SolarWinds.Agent process ID (PID) communicating specifically to the known update server IPs (e.g., 198.51.100.0/24). Alternatively, whitelist the specific SHA-256 hash of the SolarWinds updater executable if it matches a DCRat IOC file signature.
Third-Party Antivirus Cloud Telemetry
- Scenario: The enterprise deploys CrowdStrike Falcon or SentinelOne. These agents perform periodic “threat intelligence sync” tasks where they query external threat feeds to download the latest malware signatures and behavioral models. One of these feed endpoints may utilize a domain name that overlaps with DCRat’s IOCs (specifically regarding DNS queries for *.cloudflare-dns.com or similar shared infrastructure).
- Filter/Exclusion: Exclude alerts where the initiating process is CrowdStrike.exe (or SentinelOneAgent.exe) and the destination port is 443, provided the User-Agent string contains “Falcon” or “SentinelOne”. This can be implemented via a rule condition: `Process_Name IN (‘FalconService’, ‘SentinelOne’) AND Destination_Port == 44