ThreatFox: RatonRAT IOCs

Hunt Hypothesis

This hunt targets adversary activity involving five specific indicators of compromise linked to the RatonRAT remote access trojan, which is known for credential theft and lateral movement within compromised networks. Proactively hunting for these IOCs in Azure Sentinel is critical because early detection allows the SOC team to isolate infected endpoints before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Malware Family: RatonRAT Total IOCs: 5 IOC Types: sha1_hash, sha256_hash, md5_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RatonRAT
let malicious_ips = dynamic(["158.160.75.185", "81.177.49.127"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.160.75.185", "81.177.49.127"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RatonRAT
let malicious_hashes = dynamic(["4db7b73a3650b98b99aa282bf1e16cc1", "16aa5e9cd33302fb4bba5f5fe61b9dcef4e6e1a777098985eca17e5a6f075234", "3f762a0e0d991b182032fcf13cb94c75a61fe47b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RatonRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: RatonRAT IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Scanning of Quarantine Archives

  • Scenario: The organization’s EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) periodically scans the C:\ProgramData\ThreatFox\Quarantine directory. This process extracts and analyzes archived malware samples, including historical RatonRAT variants stored in .zip or .7z containers, triggering hash matches against the active IOCs without actual execution of malicious payloads.
  • Filter/Exclusion: Exclude file paths containing ThreatFox\Quarantine, Antivirus\ScanCache, or specific EDR service accounts (e.g., svc-crowdstrike-falcon-sensor) from generating alerts for this rule when the process name is falcon-sensor.exe or MsMpEng.exe.

• Software Development Lifecycle (SDLC) Artifact Analysis

  • Scenario: The DevOps team utilizes a static analysis tool (e.g., SonarQube or Checkmarx) integrated into their CI/CD pipeline. During the nightly build of a legacy internal application, the scanner downloads and unpacks third-party SDK libraries that contain known RatonRAT components used for legitimate telemetry within the development environment, matching the IOC hashes during the artifact staging phase.
  • Filter/Exclusion: Create an exclusion based on the source IP range of the CI/CD build servers (e.g., 10.20.50.0/24) and exclude processes running under the Jenkins or AzureDevOpsAgent service accounts when accessing paths within the C:\BuildArtifacts\Staging directory.

• **Scheduled Security Baseline Audits