ThreatFox: RatonRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the deployment of RatonRAT malware by detecting specific indicators of compromise across network and endpoint telemetry within Azure Sentinel. Proactive hunting for these IOCs is critical to identify early-stage remote access trojan infections before they establish persistence or exfiltrate sensitive data, ensuring rapid containment in high-severity scenarios.

IOC Summary

Malware Family: RatonRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - RatonRAT
let malicious_hashes = dynamic(["9a1983ef9feea7bdb06c17d5957db7aa", "e8573e97c75bec4b9645f40c94a1f961971aa28444e3726564f4dda1312aac25", "3ef07367be035c6524b96fd552a57f309710b34b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — RatonRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: RatonRAT IOCs detection rule, tailored for an enterprise environment:

• Antivirus Definition Updates via Microsoft Defender

  • Scenario: The daily automated update of Microsoft Defender Antivirus (or similar EDR like CrowdStrike) downloads and executes signature definition files. These updates often utilize the same network ports and file hashes that overlap with RatonRAT’s command-and-control (C2) beaconing or initial payload delivery, triggering a match on the “Network Connection” IOC.
  • Filter/Exclusion: Add an exclusion for processes originating from MsMpEng.exe (Microsoft Defender) or CrowdStrike Falcon Sensor running under the SYSTEM or NT AUTHORITY\NETWORK SERVICE account. Specifically, exclude network connections to Microsoft’s known update IP ranges (e.g., *.update.microsoft.com) and file paths within C:\ProgramData\Microsoft\Windows Defender.

• Scheduled PowerShell Script Execution for Asset Inventory

  • Scenario: A scheduled Task Scheduler job runs a custom PowerShell script (InventoryCheck.ps1) every morning to query remote servers. This script establishes outbound HTTPS connections to internal asset management tools (e.g., ServiceNow or SCCM). If the script uses a specific certificate thumbprint or connects to an IP address that shares a hash with RatonRAT’s known infrastructure, it triggers the “File Hash” and “Network Destination” IOCs.
  • Filter/Exclusion: Create a rule exclusion for powershell.exe processes launched by Task Scheduler (TASKSCHEDULER) where the command line contains specific keywords like -ExecutionPolicy Bypass -File InventoryCheck. Additionally, whitelist the destination IP addresses of internal asset management servers and the specific SHA256 hash of the legitimate inventory script.

• **Third-Party Endpoint Management Agent Communication