ThreatFox: Ghost RAT IOCs

Hunt Hypothesis

This detection rule identifies potential Ghost RAT activity by correlating three specific Indicators of Compromise (IOCs) known to be used by this remote access tool for command and control or lateral movement. Proactive hunting in Azure Sentinel is critical because Ghost RAT often operates with low visibility, allowing adversaries to establish persistent footholds that can lead to significant data exfiltration if not identified early through IOC-based correlation.

IOC Summary

Malware Family: Ghost RAT Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`137[.]220[.]158[.]91:8080`	botnet_cc	2026-08-31	99%
ip:port	`8[.]210[.]93[.]39:22`	botnet_cc	2026-08-31	99%
ip:port	`47[.]83[.]128[.]111:80`	botnet_cc	2026-08-31	99%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Ghost RAT
let malicious_ips = dynamic(["47.83.128.111", "8.210.93.39", "137.220.158.91"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.83.128.111", "8.210.93.39", "137.220.158.91"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Ghost RAT

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Ghost RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Endpoint Security Agent Scheduled Updates
- Context: Enterprise endpoint protection platforms (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) often perform scheduled signature database updates during off-hours. These updates may generate network traffic patterns or file hashes that match the Ghost RAT IOCs, particularly if the update server uses similar IP ranges or certificate fingerprints.
- Filter/Exclusion: Exclude traffic originating from the specific internal IP range of the security management servers (e.g., 10.20.5.0/24) and filter out processes named FalconService.exe or MsMpEng.exe when they initiate connections to known update endpoints during maintenance windows (e.g., 02:00–04:00 UTC).
Scenario: Third-Party Backup Solution Connectivity
- Context: Automated backup agents such as Veeam Backup & Replication or Rubrik often establish persistent connections to cloud storage buckets or on-premises repositories. The communication protocols and file transfer signatures used by these tools can mimic the command-and-control (C2) behavior of Ghost RAT, triggering false alerts when large data chunks are transferred.
- Filter/Exclusion: Create a whitelist for the backup service accounts (e.g., VeeamService or RubrikAgent) and exclude network flows where the destination port is 8443 or 9000, provided the source process hash matches the known good signature of the installed backup agent version.
Scenario: IT Admin Remote Management Sessions
- Context: System administrators frequently use remote management tools like Microsoft SCCM (Configuration Manager) or Ivanti to push patches and