ThreatFox: Interlock RAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Interlock RAT indicators, which adversaries deploy to establish persistent remote access and execute malicious payloads on compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy intrusions early, preventing the RAT from facilitating lateral movement or data exfiltration before it is fully established.

IOC Summary

Malware Family: Interlock RAT Total IOCs: 6 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Interlock RAT
let malicious_domains = dynamic(["existed-bunch-balance-councils.trycloudflare.com", "ferrari-rolling-facilities-lounge.trycloudflare.com", "galleries-physicians-psp-wv.trycloudflare.com", "evidence-deleted-procedure-bringing.trycloudflare.com", "nowhere-locked-manor-hs.trycloudflare.com", "ranked-accordingly-ab-hired.trycloudflare.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Interlock RAT

False Positive Guidance

• Scenario: A legacy Java-based application server (e.g., Tomcat or WildFly) is running a specific version of a third-party library that contains a known hash collision or a shared dependency file (such as a specific lib.jar or native .dll) that matches one of the Interlock RAT IOCs. This is common in environments where developers reuse open-source components without updating them.
  • Filter/Exclusion: Exclude alerts where the file path resides within standard Java application directories (e.g., C:\Program Files\Apache Tomcat\*, C:\opt\tomcat\*) or where the parent process is a known Java runtime (java.exe, jre\bin\java.exe).
• Scenario: An IT administrator manually deploys a custom diagnostic or patching script written in Python or PowerShell that bundles a specific third-party library (e.g., pywin32, psutil, or a specific C++ runtime library) whose binary hash matches an IOC. This often happens when scripts are copied from a shared network drive or built locally without re-hashing dependencies.
  • Filter/Exclusion: Exclude alerts where the file is located in a known administrative or staging directory (e.g., C:\AdminTools\, C:\Temp\, C:\Users\<AdminUser>\Desktop\) and the parent process is a scripting engine (python.exe, powershell.exe, pwsh.exe) or a file manager (explorer.exe, totalcmd.exe).
• Scenario: A scheduled task runs a backup or log rotation utility (e.g., VeeamAgent.exe, BackupExecAgent.exe, or a custom rotate_logs.bat) that temporarily copies a log file or configuration file to a temporary directory. If this file is a compressed archive or a specific binary that shares a hash with an IOC due to a common build