This rule identifies systems exhibiting known indicators of compromise associated with the Ghost RAT remote access Trojan, which grants adversaries the capability to execute arbitrary commands and exfiltrate sensitive data. Proactively hunting for these IOCs in Azure Sentinel is critical to detect persistent backdoors early, preventing attackers from establishing long-term control and escalating privileges within the environment.
Malware Family: Ghost RAT Total IOCs: 5 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 67[.]205[.]187[.]242:443 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 172[.]247[.]27[.]27:443 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 135[.]129[.]122[.]52:80 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 121[.]154[.]157[.]80:80 | botnet_cc | 2026-09-28 | 50% |
| ip:port | 121[.]154[.]157[.]80:443 | botnet_cc | 2026-09-28 | 50% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ghost RAT
let malicious_ips = dynamic(["135.129.122.52", "67.205.187.242", "172.247.27.27", "121.154.157.80"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["135.129.122.52", "67.205.187.242", "172.247.27.27", "121.154.157.80"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Remote Support Sessions: IT support teams using commercial remote access tools (e.g., TeamViewer, AnyDesk, or LogMeIn) often run background services or scheduled tasks that mimic RAT behavior by establishing outbound connections to known vendor IPs or using specific process names.
TeamViewer.exe, AnyDesk.exe) and exclude outbound connections to verified vendor IP ranges or domains (e.g., *.teamviewer.com, *.anydesk.com).Software Update and Telemetry Agents: Enterprise endpoint management agents (e.g., SCCM, Intune, or CrowdStrike Falcon) periodically phone home to update policy, send telemetry, or download patches. These actions can resemble Ghost RAT’s persistence mechanisms (scheduled tasks) and data exfiltration patterns (outbound HTTPS).
CcmExec.exe, FalconSensor.exe) and exclude scheduled tasks with names containing standard update keywords (e.g., *Update*, *Telemetry*, *Sync*).DevOps CI/CD Pipeline Agents: In development environments, CI/CD agents (e.g., Jenkins, GitLab Runner, or Azure DevOps agents) execute build scripts, pull dependencies, and push artifacts. These agents often run as services, create temporary files, and make outbound connections to artifact repositories, which can trigger IOCs related to file creation and network activity.
jenkins.exe, gitlab-runner.exe, vsts-agent.exe) and exclude outbound connections to internal artifact repositories or known public package registries (e.g., *.maven.org, `*.pypi