ThreatFox: NonEuclid RAT IOCs

Hunt Hypothesis

This hypothesis targets adversary behavior where threat actors deploy the NonEuclid Remote Access Trojan (RAT) to establish persistent command-and-control channels and exfiltrate sensitive data via its known indicators of compromise. A SOC team should proactively hunt for these specific IOCs within Azure Sentinel to rapidly identify early-stage infections, as NonEuclid’s sophisticated evasion capabilities often allow it to remain undetected by standard signature-based defenses until significant damage occurs.

IOC Summary

Malware Family: NonEuclid RAT Total IOCs: 14 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`91[.]92[.]47[.]228:1383`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1394`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:7000`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:8848`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1297`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1313`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1329`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1342`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1360`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1366`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1372`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1180`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1293`	botnet_cc	2026-08-14	75%
ip:port	`91[.]92[.]47[.]228:1154`	botnet_cc	2026-08-14	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - NonEuclid RAT
let malicious_ips = dynamic(["91.92.47.228"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.47.228"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — NonEuclid RAT

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: NonEuclid RAT IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Software Deployment via SCCM/Intune
- Context: The IT team deploys a new version of a remote management tool (e.g., Ivanti or ManageEngine) using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes a script that establishes persistent network connections and modifies registry keys similar to the NonEuclid RAT IOCs.
- Filter/Exclusion: Create an exclusion based on the Process Name being ccmsetup.exe or intuneagent.exe, combined with a filter where the User Account matches the service account used for deployments (e.g., DOMAIN\SCCM_Service).
Scenario: Scheduled Backup Job Execution
- Context: A nightly scheduled task runs using Veeam Agent for Windows or Acronis Cyber Protect. During the backup window, the agent initiates multiple outbound connections to the backup repository and creates specific registry entries for status tracking that match the IOCs associated with NonEuclid’s communication patterns.
- Filter/Exclusion: Exclude alerts where the Parent Process is TaskScheduler.exe or svchost.exe (specifically the Veeam service) AND the execution time falls within the defined maintenance window (e.g., 02:00 to 04:00 local time).
Scenario: Admin Remote Session via RDP/TeamViewer
- Context: A system administrator performs a remote troubleshooting session using TeamViewer or AnyDesk. These tools often utilize similar network ports and registry modification patterns (specifically in HKLM\Software) to establish the remote control tunnel, triggering the NonEuclid RAT detection logic.